[ipfire-2.x.git] / src / misc-progs / openvpnctrl.c

#include <signal.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <fcntl.h>
#include "setuid.h"
#include "netutil.h"
#include "libsmooth.h"

#define noovpndebug

// global vars
	struct keyvalue *kv = NULL;
	FILE *ifacefile = NULL;

char redif[STRING_SIZE];
char blueif[STRING_SIZE];
char orangeif[STRING_SIZE];
char enablered[STRING_SIZE] = "off";
char enableblue[STRING_SIZE] = "off";
char enableorange[STRING_SIZE] = "off";

// consts
char OVPNINPUT[STRING_SIZE] = "OVPNINPUT";
char OVPNBLOCK[STRING_SIZE] = "OVPNBLOCK";
char OVPNNAT[STRING_SIZE] = "OVPNNAT";
char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.4";

struct connection_struct {
	char name[STRING_SIZE];
	char type[STRING_SIZE];
	char proto[STRING_SIZE];
	char status[STRING_SIZE];
	char local_subnet[STRING_SIZE];
	char transfer_subnet[STRING_SIZE];
	char role[STRING_SIZE];
	char port[STRING_SIZE];
	struct connection_struct *next;
};

typedef struct connection_struct connection;

void exithandler(void)
{
	if(kv)
		freekeyvalues(kv);
	if (ifacefile)
		fclose(ifacefile);
}

void usage(void)
{
#ifdef ovpndebug
	printf("Wrapper for OpenVPN %s-debug\n", WRAPPERVERSION);
#else
	printf("Wrapper for OpenVPN %s\n", WRAPPERVERSION);
#endif
	printf("openvpnctrl <option>\n");
	printf(" Valid options are:\n");
	printf(" -s   --start\n");
	printf("      starts OpenVPN (implicitly creates chains and firewall rules)\n");
	printf(" -k   --kill\n");
	printf("      kills/stops OpenVPN\n");
	printf(" -r   --restart\n");
	printf("      restarts OpenVPN (implicitly creates chains and firewall rules)\n");
	printf(" -sn2n --start-net-2-net\n");
	printf("      starts all net2net connections\n");
	printf("      you may pass a connection name to the switch to only start a specific one\n");
	printf(" -kn2n --kill-net-2-net\n");
	printf("      kills all net2net connections\n");
	printf("      you may pass a connection name to the switch to only start a specific one\n");
	printf(" -drrd --delete-rrd\n");
	printf("      Deletes the RRD data for a specific client\n");
	printf("      you need to pass a connection name (RW) to the switch to delete the directory (case sensitive)\n");
	printf(" -d   --display\n");
	printf("      displays OpenVPN status to syslog\n");
	printf(" -fwr --firewall-rules\n");
	printf("      removes current OpenVPN chains and rules and resets them according to the config\n");
	printf(" -sdo --start-daemon-only\n");
	printf("      starts OpenVPN daemon only\n");
	exit(1);
}

connection *getConnections() {
	FILE *fp = NULL;

	if (!(fp = fopen(CONFIG_ROOT "/ovpn/ovpnconfig", "r"))) {
		fprintf(stderr, "Could not open openvpn n2n configuration file.\n");
		exit(1);
	}

	char line[STRING_SIZE] = "";
	char result[STRING_SIZE] = "";
	char *resultptr;
	int count;
	connection *conn_first = NULL;
	connection *conn_last = NULL;
	connection *conn_curr;

	while ((fgets(line, STRING_SIZE, fp) != NULL)) {
		if (line[strlen(line) - 1] == '\n')
			line[strlen(line) - 1] = '\0';

		conn_curr = (connection *)malloc(sizeof(connection));
		memset(conn_curr, 0, sizeof(connection));

		if (conn_first == NULL) {
			conn_first = conn_curr;
		} else {
			conn_last->next = conn_curr;
		}
		conn_last = conn_curr;

		count = 0;
		char *lineptr = &line;
		while (1) {
			if (*lineptr == NULL)
				break;

			resultptr = result;
			while (*lineptr != NULL) {
				if (*lineptr == ',') {
					lineptr++;
					break;
				}
				*resultptr++ = *lineptr++;
			}
			*resultptr = '\0';

			if (count == 1) {
				strcpy(conn_curr->status, result);
			} else if (count == 2) {
				strcpy(conn_curr->name, result);
			} else if (count == 4) {
				strcpy(conn_curr->type, result);
			} else if (count == 7) {
				strcpy(conn_curr->role, result);
			} else if (count == 9) {
				strcpy(conn_curr->local_subnet, result);
			} else if (count == 28) {
				strcpy(conn_curr->transfer_subnet, result);
			} else if (count == 29) {
				strcpy(conn_curr->proto, result);
			} else if (count == 30) {
				strcpy(conn_curr->port, result);
			}

			count++;
		}
	}

	fclose(fp);

	return conn_first;
}

int readPidFile(const char *pidfile) {
	FILE *fp = fopen(pidfile, "r");
	if (fp == NULL) {
		exit(1);
	}

	int pid = 0;
	fscanf(fp, "%d", &pid);
	fclose(fp);

	return pid;
}

int readExternalAddress(char* address) {
	FILE *fp = fopen("/var/ipfire/red/local-ipaddress", "r");
	if (!fp)
		goto ERROR;

	int r = fscanf(fp, "%s", address);
	fclose(fp);

	if (r < 0)
		goto ERROR;

	/* In case the read IP address is not valid, we empty
	 * the content of address and return non-zero. */
	if (!VALID_IP(address))
		goto ERROR;

	return 0;

ERROR:
	address = NULL;
	return 1;
}

void ovpnInit(void) {
	// Read OpenVPN configuration
	kv = initkeyvalues();
	if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings")) {
		fprintf(stderr, "Cannot read ovpn settings\n");
		exit(1);
	}

	if (!findkey(kv, "ENABLED", enablered)) {
		exit(1);
	}

	if (!findkey(kv, "ENABLED_BLUE", enableblue)){
		exit(1);
	}

	if (!findkey(kv, "ENABLED_ORANGE", enableorange)){
		exit(1);
	}
	freekeyvalues(kv);

	// read interface settings

	// details for the red int
	memset(redif, 0, STRING_SIZE);
	if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r")))
	{
		if (fgets(redif, STRING_SIZE, ifacefile))
		{
			if (redif[strlen(redif) - 1] == '\n')
				redif[strlen(redif) - 1] = '\0';
		}
		fclose (ifacefile);
		ifacefile = NULL;

		if (!VALID_DEVICE(redif))
		{
			memset(redif, 0, STRING_SIZE);
		}
	}

	kv=initkeyvalues();
	if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
		fprintf(stderr, "Cannot read ethernet settings\n");
		exit(1);
	}
	
	if (strcmp(enableblue, "on") == 0) {
		if (!findkey(kv, "BLUE_DEV", blueif)) {
			exit(1);
		}
	}

	if (strcmp(enableorange, "on") == 0) {
		if (!findkey(kv, "ORANGE_DEV", orangeif)) {
			exit(1);
		}
	}
	freekeyvalues(kv);
}

void executeCommand(char *command) {
#ifdef ovpndebug
	printf(strncat(command, "\n", 2));
#endif
	safe_system(strncat(command, " >/dev/null 2>&1", 17));
}

void addRule(const char *chain, const char *interface, const char *protocol, const char *port) {
	char command[STRING_SIZE];

	snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -i %s -p %s --dport %s -j ACCEPT",
		chain, interface, protocol, port);
	executeCommand(command);
}

void flushChain(char *chain) {
	char str[STRING_SIZE];

	snprintf(str, STRING_SIZE - 1, "/sbin/iptables -F %s", chain);
	executeCommand(str);
}

void flushChainNAT(char *chain) {
	char str[STRING_SIZE];

	snprintf(str, STRING_SIZE - 1, "/sbin/iptables -t nat -F %s", chain);
	executeCommand(str);
}

char* calcTransferNetAddress(const connection* conn) {
	char *subnetmask = strdup(conn->transfer_subnet);
	char *address = strsep(&subnetmask, "/");

	if ((address == NULL) || (subnetmask == NULL)) {
		goto ERROR;
	}

	in_addr_t _address    = inet_addr(address);
	in_addr_t _subnetmask = inet_addr(subnetmask);
	_address &= _subnetmask;

	if (strcmp(conn->role, "server") == 0) {
		_address += 1 << 24;
	} else if (strcmp(conn->role, "client") == 0) {
		_address += 2 << 24;
	} else {
		goto ERROR;
	}

	struct in_addr address_info;
	address_info.s_addr = _address;

	return inet_ntoa(address_info);

ERROR:
	fprintf(stderr, "Could not determine transfer net address: %s\n", conn->name);

	free(address);
	return NULL;
}

char* getLocalSubnetAddress(const connection* conn) {
	kv = initkeyvalues();
	if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
		fprintf(stderr, "Cannot read ethernet settings\n");
		exit(1);
	}

	const char *zones[] = {"GREEN", "BLUE", "ORANGE", NULL};
	char *zone = NULL;

	// Get net address of the local openvpn subnet.
	char *subnetmask = strdup(conn->local_subnet);
	char *address = strsep(&subnetmask, "/");

	if ((address == NULL) || (subnetmask == NULL)) {
		goto ERROR;
	}

	in_addr_t _address    = inet_addr(address);
	in_addr_t _subnetmask = inet_addr(subnetmask);

	in_addr_t _netaddr    = (_address &  _subnetmask);
	in_addr_t _broadcast  = (_address | ~_subnetmask);

	char zone_address_key[STRING_SIZE];
	char zone_address[STRING_SIZE];
	in_addr_t zone_addr;

	int i = 0;
	while (zones[i]) {
		zone = zones[i++];
		snprintf(zone_address_key, STRING_SIZE, "%s_ADDRESS", zone);

		if (!findkey(kv, zone_address_key, zone_address))
			continue;

		zone_addr = inet_addr(zone_address);
		if ((zone_addr > _netaddr) && (zone_addr < _broadcast)) {
			freekeyvalues(kv);

			return strdup(zone_address);
		}
	}

ERROR:
	fprintf(stderr, "Could not determine local subnet address: %s\n", conn->name);

	freekeyvalues(kv);
	return NULL;
}

void setFirewallRules(void) {
	char command[STRING_SIZE];
	char protocol[STRING_SIZE] = "";
	char dport[STRING_SIZE] = "";
	char dovpnip[STRING_SIZE] = "";

	kv = initkeyvalues();
	if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings"))
	{
		fprintf(stderr, "Cannot read ovpn settings\n");
		exit(1);
	}

	/* we got one device, so lets proceed further	*/	
	if (!findkey(kv, "DDEST_PORT", dport)){
		fprintf(stderr, "Cannot read DDEST_PORT\n");
		exit(1);
	}

	if (!findkey(kv, "DPROTOCOL", protocol)){
		fprintf(stderr, "Cannot read DPROTOCOL\n");
		exit(1);
	}

	if (!findkey(kv, "VPN_IP", dovpnip)){
		fprintf(stderr, "Cannot read VPN_IP\n");
	}
	freekeyvalues(kv);

	// Flush all chains.
	flushChain(OVPNINPUT);
	flushChain(OVPNBLOCK);
	flushChainNAT(OVPNNAT);

	// set firewall rules
	if (!strcmp(enablered, "on") && strlen(redif))
		addRule(OVPNINPUT, redif, protocol, dport);
	if (!strcmp(enableblue, "on") && strlen(blueif))
		addRule(OVPNINPUT, blueif, protocol, dport);
	if (!strcmp(enableorange, "on") && strlen(orangeif))
		addRule(OVPNINPUT, orangeif, protocol, dport);

	/* Allow ICMP error messages to pass. */
	snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -p icmp"
		" -m conntrack --ctstate RELATED -j RETURN", OVPNBLOCK);
	executeCommand(command);

	// read connection configuration
	connection *conn = getConnections();

	// set firewall rules for n2n connections
	char *local_subnet_address = NULL;
	char *transfer_subnet_address = NULL;
	while (conn != NULL) {
		if (strcmp(conn->type, "net") == 0) {
			addRule(OVPNINPUT, redif, conn->proto, conn->port);

			/* Block all communication from the transfer nets. */
			snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -s %s -j DROP",
				OVPNBLOCK, conn->transfer_subnet);
			executeCommand(command);

			local_subnet_address = getLocalSubnetAddress(conn);
			transfer_subnet_address = calcTransferNetAddress(conn);

			if ((local_subnet_address) && (transfer_subnet_address)) {
				snprintf(command, STRING_SIZE - 1, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
					OVPNNAT, transfer_subnet_address, local_subnet_address);
				executeCommand(command);
			}
		}

		conn = conn->next;
	}
}

void stopDaemon(void) {
	char command[STRING_SIZE];

	int pid = readPidFile("/var/run/openvpn.pid");
	if (!pid > 0) {
		exit(1);
	}

	fprintf(stderr, "Killing PID %d.\n", pid);
	kill(pid, SIGTERM);

	snprintf(command, STRING_SIZE - 1, "/bin/rm -f /var/run/openvpn.pid");
	executeCommand(command);
}

void startDaemon(void) {
	char command[STRING_SIZE];
	
	if (!((strcmp(enablered, "on") == 0) || (strcmp(enableblue, "on") == 0) || (strcmp(enableorange, "on") == 0))) {
		fprintf(stderr, "OpenVPN is not enabled on any interface\n");
		exit(1);
	} else {
		snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
		executeCommand(command);
		snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config /var/ipfire/ovpn/server.conf");
		executeCommand(command);
	}
}

int startNet2Net(char *name) {
	connection *conn = NULL;
	connection *conn_iter;

	conn_iter = getConnections();

	while (conn_iter) {
		if ((strcmp(conn_iter->type, "net") == 0) && (strcmp(conn_iter->name, name) == 0)) {
			conn = conn_iter;
			break;
		}
		conn_iter = conn_iter->next;
	}

	if (conn == NULL) {
		fprintf(stderr, "Connection not found.\n");
		return 1;
	}

	if (strcmp(conn->status, "on") != 0) {
		fprintf(stderr, "Connection '%s' is not enabled.\n", conn->name);
		return 1;
	}

	fprintf(stderr, "Starting connection %s...\n", conn->name);

	char configfile[STRING_SIZE];
	snprintf(configfile, STRING_SIZE - 1, CONFIG_ROOT "/ovpn/n2nconf/%s/%s.conf",
		conn->name, conn->name);

	FILE *fp = fopen(configfile, "r");
	if (fp == NULL) {
		fprintf(stderr, "Could not find configuration file for connection '%s' at '%s'.\n",
			conn->name, configfile);
		return 2;
	}
	fclose(fp);

	// Make sure all firewall rules are up to date.
	setFirewallRules();

	// Get the external IP address.
	char address[STRING_SIZE] = "";
	int r = readExternalAddress(address);
	if (r) {
		fprintf(stderr, "Could not read the external address\n");
		exit(1);
	}

	char command[STRING_SIZE];
	snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
	executeCommand(command);
	snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --local %s --config %s", address, configfile);
	executeCommand(command);

	return 0;
}

int killNet2Net(char *name) {
	connection *conn = NULL;
	connection *conn_iter;

	conn_iter = getConnections();

	while (conn_iter) {
		if (strcmp(conn_iter->name, name) == 0) {
			conn = conn_iter;
			break;
		}
		conn_iter = conn_iter->next;
	}

	if (conn == NULL) {
		fprintf(stderr, "Connection not found.\n");
		return 1;
	}

	char pidfile[STRING_SIZE];
	snprintf(pidfile, STRING_SIZE - 1, "/var/run/%sn2n.pid", conn->name);

	int pid = readPidFile(pidfile);
	if (!pid > 0) {
		fprintf(stderr, "Could not read pid file of connection %s.", conn->name);
		return 1;
	}

	fprintf(stderr, "Killing connection %s (PID %d)...\n", conn->name, pid);
	kill(pid, SIGTERM);

	char command[STRING_SIZE];
	snprintf(command, STRING_SIZE - 1, "/bin/rm -f %s", pidfile);
	executeCommand(command);

	return 0;
}

int deleterrd(char *name) {
	connection *conn = getConnections();

	char rrd_file[STRING_SIZE];
	snprintf(rrd_file, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s/if_octets.rrd", name);

	char rrd_dir[STRING_SIZE];
	snprintf(rrd_dir, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s", name);

	while(conn) {
		/* Find only RW-Connections with the given name. */
		if (((strcmp(conn->type, "host") == 0) && (strcmp(conn->name, name) == 0))) {
			remove(rrd_file);
			remove(rrd_dir);
			return 0;
		}
		conn = conn->next;
	}

	return 1;
}

void startAllNet2Net() {
	int exitcode = 0, _exitcode = 0;

	connection *conn = getConnections();

	while(conn) {
		/* Skip all connections that are not of type "net" or disabled. */
		if ((strcmp(conn->type, "net") != 0) || (strcmp(conn->status, "on") != 0)) {
			conn = conn->next;
			continue;
		}

		_exitcode = startNet2Net(conn->name);
		conn = conn->next;

		if (_exitcode > exitcode) {
			exitcode = _exitcode;
		}
	}

	exit(exitcode);
}

void killAllNet2Net() {
	int exitcode = 0, _exitcode = 0;

	connection *conn = getConnections();

	while(conn) {
		/* Skip all connections that are not of type "net". */
		if (strcmp(conn->type, "net") != 0) {
			conn = conn->next;
			continue;
		}

		_exitcode = killNet2Net(conn->name);
		conn = conn->next;

		if (_exitcode > exitcode) {
			exitcode = _exitcode;
		}
	}

	exit(exitcode);
}

void displayopenvpn(void) {
	char command[STRING_SIZE];

	snprintf(command, STRING_SIZE - 1, "/bin/killall -sSIGUSR2 openvpn");
	executeCommand(command);
}

int main(int argc, char *argv[]) {
	if (!(initsetuid()))
	    exit(1);
	if(argc < 2)
	    usage();

	if(argc == 3) {
		ovpnInit();

		if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
			startNet2Net(argv[2]);
			return 0;
		}
		else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
			killNet2Net(argv[2]);
			return 0;
		}
		else if( (strcmp(argv[1], "-drrd") == 0) || (strcmp(argv[1], "--delete-rrd") == 0) ) {
			deleterrd(argv[2]);
			return 0;
		} else {
			usage();
			return 1;
		}
	}
	else if(argc == 2) {
		if( (strcmp(argv[1], "-k") == 0) || (strcmp(argv[1], "--kill") == 0) ) {
			stopDaemon();
			return 0;
		}
		else if( (strcmp(argv[1], "-d") == 0) || (strcmp(argv[1], "--display") == 0) ) {
			displayopenvpn();
			return 0;
		}
		else {
			ovpnInit();
			
			if( (strcmp(argv[1], "-s") == 0) || (strcmp(argv[1], "--start") == 0) ) {
				setFirewallRules();
				startDaemon();
				return 0;
			}
			else if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
				startAllNet2Net();
				return 0;
			}
			else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
				killAllNet2Net();
				return 0;
			}
			else if( (strcmp(argv[1], "-sdo") == 0) || (strcmp(argv[1], "--start-daemon-only") == 0) ) {
				startDaemon();
				return 0;
			}
			else if( (strcmp(argv[1], "-r") == 0) || (strcmp(argv[1], "--restart") == 0) ) {
				stopDaemon();
				setFirewallRules();
				startDaemon();
				return 0;
			}
			else if( (strcmp(argv[1], "-fwr") == 0) || (strcmp(argv[1], "--firewall-rules") == 0) ) {
				setFirewallRules();
				return 0;
			}
			else {
				usage();
				return 0;
			}
		}
	}
	else {
		usage();
		return 0;
	}
return 0;
}
Commit	Line	Data
39877197	1	#include <signal.h>
6e13d0a5 MT	2	#include <stdio.h>
	3	#include <string.h>
	4	#include <unistd.h>
	5	#include <stdlib.h>
	6	#include <sys/types.h>
3d1fbbb0 MT	7	#include <arpa/inet.h>
3d1fbbb0 MT	8	#include <netinet/in.h>
6e13d0a5 MT	9	#include <fcntl.h>
6e13d0a5 MT	10	#include "setuid.h"
52e54c1c	11	#include "netutil.h"
6e13d0a5 MT	12	#include "libsmooth.h"
6e13d0a5 MT	13
c894a342	14	#define noovpndebug
6e13d0a5 MT	15
	16	// global vars
	17	struct keyvalue *kv = NULL;
	18	FILE *ifacefile = NULL;
	19
	20	char redif[STRING_SIZE];
	21	char blueif[STRING_SIZE];
	22	char orangeif[STRING_SIZE];
	23	char enablered[STRING_SIZE] = "off";
	24	char enableblue[STRING_SIZE] = "off";
	25	char enableorange[STRING_SIZE] = "off";
	26
	27	// consts
ab4876ad	28	char OVPNINPUT[STRING_SIZE] = "OVPNINPUT";
c31f18b6	29	char OVPNBLOCK[STRING_SIZE] = "OVPNBLOCK";
3d1fbbb0	30	char OVPNNAT[STRING_SIZE] = "OVPNNAT";
ab4876ad	31	char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.4";
6925b8ef AF	32
	33	struct connection_struct {
	34	char name[STRING_SIZE];
91a0a221	35	char type[STRING_SIZE];
6925b8ef	36	char proto[STRING_SIZE];
99b01b84	37	char status[STRING_SIZE];
3d1fbbb0 MT	38	char local_subnet[STRING_SIZE];
	39	char transfer_subnet[STRING_SIZE];
	40	char role[STRING_SIZE];
ab4876ad	41	char port[STRING_SIZE];
6925b8ef AF	42	struct connection_struct *next;
	43	};
	44
	45	typedef struct connection_struct connection;
6e13d0a5 MT	46
	47	void exithandler(void)
	48	{
	49	if(kv)
	50	freekeyvalues(kv);
	51	if (ifacefile)
	52	fclose(ifacefile);
	53	}
	54
	55	void usage(void)
	56	{
	57	#ifdef ovpndebug
07081137	58	printf("Wrapper for OpenVPN %s-debug\n", WRAPPERVERSION);
6e13d0a5	59	#else
07081137	60	printf("Wrapper for OpenVPN %s\n", WRAPPERVERSION);
6e13d0a5 MT	61	#endif
	62	printf("openvpnctrl <option>\n");
	63	printf(" Valid options are:\n");
	64	printf(" -s --start\n");
	65	printf(" starts OpenVPN (implicitly creates chains and firewall rules)\n");
	66	printf(" -k --kill\n");
	67	printf(" kills/stops OpenVPN\n");
	68	printf(" -r --restart\n");
	69	printf(" restarts OpenVPN (implicitly creates chains and firewall rules)\n");
64f0c354 MT	70	printf(" -sn2n --start-net-2-net\n");
	71	printf(" starts all net2net connections\n");
	72	printf(" you may pass a connection name to the switch to only start a specific one\n");
	73	printf(" -kn2n --kill-net-2-net\n");
	74	printf(" kills all net2net connections\n");
	75	printf(" you may pass a connection name to the switch to only start a specific one\n");
5795fc1b AM	76	printf(" -drrd --delete-rrd\n");
	77	printf(" Deletes the RRD data for a specific client\n");
	78	printf(" you need to pass a connection name (RW) to the switch to delete the directory (case sensitive)\n");
6e13d0a5 MT	79	printf(" -d --display\n");
	80	printf(" displays OpenVPN status to syslog\n");
	81	printf(" -fwr --firewall-rules\n");
	82	printf(" removes current OpenVPN chains and rules and resets them according to the config\n");
	83	printf(" -sdo --start-daemon-only\n");
afabe9f7	84	printf(" starts OpenVPN daemon only\n");
6e13d0a5 MT	85	exit(1);
	86	}
	87
6925b8ef AF	88	connection *getConnections() {
	89	FILE *fp = NULL;
	90
	91	if (!(fp = fopen(CONFIG_ROOT "/ovpn/ovpnconfig", "r"))) {
	92	fprintf(stderr, "Could not open openvpn n2n configuration file.\n");
	93	exit(1);
	94	}
	95
	96	char line[STRING_SIZE] = "";
d4f2fb97 MT	97	char result[STRING_SIZE] = "";
d4f2fb97 MT	98	char *resultptr;
6925b8ef AF	99	int count;
	100	connection *conn_first = NULL;
	101	connection *conn_last = NULL;
	102	connection *conn_curr;
	103
	104	while ((fgets(line, STRING_SIZE, fp) != NULL)) {
	105	if (line[strlen(line) - 1] == '\n')
	106	line[strlen(line) - 1] = '\0';
	107
	108	conn_curr = (connection *)malloc(sizeof(connection));
	109	memset(conn_curr, 0, sizeof(connection));
	110
	111	if (conn_first == NULL) {
	112	conn_first = conn_curr;
	113	} else {
	114	conn_last->next = conn_curr;
	115	}
	116	conn_last = conn_curr;
	117
	118	count = 0;
d4f2fb97 MT	119	char *lineptr = &line;
	120	while (1) {
	121	if (*lineptr == NULL)
	122	break;
	123
	124	resultptr = result;
	125	while (*lineptr != NULL) {
	126	if (*lineptr == ',') {
	127	lineptr++;
	128	break;
	129	}
	130	resultptr++ = lineptr++;
	131	}
	132	*resultptr = '\0';
	133
99b01b84 MT	134	if (count == 1) {
	135	strcpy(conn_curr->status, result);
	136	} else if (count == 2) {
6925b8ef	137	strcpy(conn_curr->name, result);
91a0a221 MT	138	} else if (count == 4) {
91a0a221 MT	139	strcpy(conn_curr->type, result);
3d1fbbb0 MT	140	} else if (count == 7) {
	141	strcpy(conn_curr->role, result);
	142	} else if (count == 9) {
	143	strcpy(conn_curr->local_subnet, result);
	144	} else if (count == 28) {
	145	strcpy(conn_curr->transfer_subnet, result);
d4f2fb97	146	} else if (count == 29) {
6925b8ef	147	strcpy(conn_curr->proto, result);
d4f2fb97	148	} else if (count == 30) {
ab4876ad	149	strcpy(conn_curr->port, result);
6925b8ef AF	150	}
6925b8ef AF	151
6925b8ef AF	152	count++;
	153	}
	154	}
	155
	156	fclose(fp);
	157
	158	return conn_first;
	159	}
	160
80ca8bd0 MT	161	int readPidFile(const char *pidfile) {
	162	FILE *fp = fopen(pidfile, "r");
	163	if (fp == NULL) {
80ca8bd0 MT	164	exit(1);
	165	}
	166
	167	int pid = 0;
	168	fscanf(fp, "%d", &pid);
	169	fclose(fp);
	170
	171	return pid;
	172	}
	173
e1a51ebb SS	174	int readExternalAddress(char* address) {
	175	FILE *fp = fopen("/var/ipfire/red/local-ipaddress", "r");
	176	if (!fp)
	177	goto ERROR;
	178
	179	int r = fscanf(fp, "%s", address);
	180	fclose(fp);
	181
	182	if (r < 0)
	183	goto ERROR;
	184
	185	/* In case the read IP address is not valid, we empty
	186	* the content of address and return non-zero. */
	187	if (!VALID_IP(address))
	188	goto ERROR;
	189
	190	return 0;
	191
	192	ERROR:
	193	address = NULL;
	194	return 1;
	195	}
	196
6e13d0a5	197	void ovpnInit(void) {
6e13d0a5 MT	198	// Read OpenVPN configuration
	199	kv = initkeyvalues();
	200	if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings")) {
	201	fprintf(stderr, "Cannot read ovpn settings\n");
	202	exit(1);
	203	}
	204
	205	if (!findkey(kv, "ENABLED", enablered)) {
6e13d0a5 MT	206	exit(1);
	207	}
	208
	209	if (!findkey(kv, "ENABLED_BLUE", enableblue)){
6e13d0a5 MT	210	exit(1);
	211	}
	212
	213	if (!findkey(kv, "ENABLED_ORANGE", enableorange)){
6e13d0a5 MT	214	exit(1);
	215	}
	216	freekeyvalues(kv);
	217
	218	// read interface settings
	219
	220	// details for the red int
	221	memset(redif, 0, STRING_SIZE);
	222	if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r")))
	223	{
	224	if (fgets(redif, STRING_SIZE, ifacefile))
	225	{
	226	if (redif[strlen(redif) - 1] == '\n')
	227	redif[strlen(redif) - 1] = '\0';
	228	}
	229	fclose (ifacefile);
	230	ifacefile = NULL;
	231
	232	if (!VALID_DEVICE(redif))
	233	{
	234	memset(redif, 0, STRING_SIZE);
	235	}
	236	}
	237
	238	kv=initkeyvalues();
3ad23ee1	239	if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
6e13d0a5 MT	240	fprintf(stderr, "Cannot read ethernet settings\n");
	241	exit(1);
	242	}
	243
3ad23ee1 MT	244	if (strcmp(enableblue, "on") == 0) {
3ad23ee1 MT	245	if (!findkey(kv, "BLUE_DEV", blueif)) {
6e13d0a5 MT	246	exit(1);
	247	}
	248	}
3ad23ee1 MT	249
	250	if (strcmp(enableorange, "on") == 0) {
	251	if (!findkey(kv, "ORANGE_DEV", orangeif)) {
6e13d0a5 MT	252	exit(1);
6e13d0a5 MT	253	}
3ad23ee1	254	}
6e13d0a5 MT	255	freekeyvalues(kv);
	256	}
	257
	258	void executeCommand(char *command) {
	259	#ifdef ovpndebug
	260	printf(strncat(command, "\n", 2));
	261	#endif
	262	safe_system(strncat(command, " >/dev/null 2>&1", 17));
	263	}
	264
ab4876ad MT	265	void addRule(const char chain, const char interface, const char protocol, const char port) {
ab4876ad MT	266	char command[STRING_SIZE];
07081137	267
ab4876ad MT	268	snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -i %s -p %s --dport %s -j ACCEPT",
	269	chain, interface, protocol, port);
	270	executeCommand(command);
6e13d0a5 MT	271	}
	272
	273	void flushChain(char *chain) {
	274	char str[STRING_SIZE];
	275
ab4876ad	276	snprintf(str, STRING_SIZE - 1, "/sbin/iptables -F %s", chain);
6e13d0a5	277	executeCommand(str);
6e13d0a5 MT	278	}
6e13d0a5 MT	279
3d1fbbb0 MT	280	void flushChainNAT(char *chain) {
	281	char str[STRING_SIZE];
	282
ab4876ad	283	snprintf(str, STRING_SIZE - 1, "/sbin/iptables -t nat -F %s", chain);
6e13d0a5	284	executeCommand(str);
6e13d0a5 MT	285	}
6e13d0a5 MT	286
3d1fbbb0	287	char* calcTransferNetAddress(const connection* conn) {
a19ff965 MT	288	char *subnetmask = strdup(conn->transfer_subnet);
a19ff965 MT	289	char *address = strsep(&subnetmask, "/");
3d1fbbb0	290
cdbe3504 MT	291	if ((address == NULL) \|\| (subnetmask == NULL)) {
	292	goto ERROR;
	293	}
	294
a19ff965 MT	295	in_addr_t _address = inet_addr(address);
	296	in_addr_t _subnetmask = inet_addr(subnetmask);
	297	_address &= _subnetmask;
3d1fbbb0	298
a19ff965 MT	299	if (strcmp(conn->role, "server") == 0) {
	300	_address += 1 << 24;
	301	} else if (strcmp(conn->role, "client") == 0) {
	302	_address += 2 << 24;
3d1fbbb0 MT	303	} else {
	304	goto ERROR;
	305	}
	306
a19ff965 MT	307	struct in_addr address_info;
	308	address_info.s_addr = _address;
	309
	310	return inet_ntoa(address_info);
3d1fbbb0 MT	311
3d1fbbb0 MT	312	ERROR:
a19ff965 MT	313	fprintf(stderr, "Could not determine transfer net address: %s\n", conn->name);
a19ff965 MT	314
3d1fbbb0 MT	315	free(address);
	316	return NULL;
	317	}
	318
	319	char* getLocalSubnetAddress(const connection* conn) {
	320	kv = initkeyvalues();
	321	if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
	322	fprintf(stderr, "Cannot read ethernet settings\n");
	323	exit(1);
	324	}
	325
	326	const char *zones[] = {"GREEN", "BLUE", "ORANGE", NULL};
	327	char *zone = NULL;
	328
	329	// Get net address of the local openvpn subnet.
	330	char *subnetmask = strdup(conn->local_subnet);
	331	char *address = strsep(&subnetmask, "/");
	332
	333	if ((address == NULL) \|\| (subnetmask == NULL)) {
	334	goto ERROR;
	335	}
	336
	337	in_addr_t _address = inet_addr(address);
	338	in_addr_t _subnetmask = inet_addr(subnetmask);
	339
	340	in_addr_t _netaddr = (_address & _subnetmask);
	341	in_addr_t _broadcast = (_address \| ~_subnetmask);
	342
	343	char zone_address_key[STRING_SIZE];
	344	char zone_address[STRING_SIZE];
	345	in_addr_t zone_addr;
	346
	347	int i = 0;
	348	while (zones[i]) {
	349	zone = zones[i++];
	350	snprintf(zone_address_key, STRING_SIZE, "%s_ADDRESS", zone);
	351
	352	if (!findkey(kv, zone_address_key, zone_address))
	353	continue;
	354
	355	zone_addr = inet_addr(zone_address);
	356	if ((zone_addr > _netaddr) && (zone_addr < _broadcast)) {
	357	freekeyvalues(kv);
	358
	359	return strdup(zone_address);
	360	}
	361	}
	362
	363	ERROR:
a19ff965 MT	364	fprintf(stderr, "Could not determine local subnet address: %s\n", conn->name);
a19ff965 MT	365
3d1fbbb0 MT	366	freekeyvalues(kv);
	367	return NULL;
	368	}
	369
6e13d0a5	370	void setFirewallRules(void) {
5c3de120	371	char command[STRING_SIZE];
6e13d0a5 MT	372	char protocol[STRING_SIZE] = "";
	373	char dport[STRING_SIZE] = "";
	374	char dovpnip[STRING_SIZE] = "";
	375
6e13d0a5 MT	376	kv = initkeyvalues();
	377	if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings"))
	378	{
	379	fprintf(stderr, "Cannot read ovpn settings\n");
	380	exit(1);
	381	}
	382
	383	/* we got one device, so lets proceed further */
	384	if (!findkey(kv, "DDEST_PORT", dport)){
	385	fprintf(stderr, "Cannot read DDEST_PORT\n");
	386	exit(1);
	387	}
	388
	389	if (!findkey(kv, "DPROTOCOL", protocol)){
	390	fprintf(stderr, "Cannot read DPROTOCOL\n");
	391	exit(1);
	392	}
	393
	394	if (!findkey(kv, "VPN_IP", dovpnip)){
	395	fprintf(stderr, "Cannot read VPN_IP\n");
6e13d0a5 MT	396	}
	397	freekeyvalues(kv);
	398
07081137	399	// Flush all chains.
ab4876ad	400	flushChain(OVPNINPUT);
2181b555	401	flushChain(OVPNBLOCK);
3d1fbbb0	402	flushChainNAT(OVPNNAT);
07081137	403
6e13d0a5 MT	404	// set firewall rules
6e13d0a5 MT	405	if (!strcmp(enablered, "on") && strlen(redif))
ab4876ad	406	addRule(OVPNINPUT, redif, protocol, dport);
6e13d0a5	407	if (!strcmp(enableblue, "on") && strlen(blueif))
ab4876ad	408	addRule(OVPNINPUT, blueif, protocol, dport);
6e13d0a5	409	if (!strcmp(enableorange, "on") && strlen(orangeif))
ab4876ad	410	addRule(OVPNINPUT, orangeif, protocol, dport);
6925b8ef	411
5c3de120 MT	412	/* Allow ICMP error messages to pass. */
	413	snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -p icmp"
	414	" -m conntrack --ctstate RELATED -j RETURN", OVPNBLOCK);
	415	executeCommand(command);
	416
91a0a221 MT	417	// read connection configuration
	418	connection *conn = getConnections();
	419
6925b8ef	420	// set firewall rules for n2n connections
3d1fbbb0 MT	421	char *local_subnet_address = NULL;
3d1fbbb0 MT	422	char *transfer_subnet_address = NULL;
7d653d51	423	while (conn != NULL) {
91a0a221	424	if (strcmp(conn->type, "net") == 0) {
ab4876ad	425	addRule(OVPNINPUT, redif, conn->proto, conn->port);
3d1fbbb0	426
c31f18b6	427	/* Block all communication from the transfer nets. */
ab4876ad	428	snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -s %s -j DROP",
c31f18b6 MT	429	OVPNBLOCK, conn->transfer_subnet);
	430	executeCommand(command);
	431
3d1fbbb0 MT	432	local_subnet_address = getLocalSubnetAddress(conn);
	433	transfer_subnet_address = calcTransferNetAddress(conn);
	434
cdbe3504	435	if ((local_subnet_address) && (transfer_subnet_address)) {
ab4876ad	436	snprintf(command, STRING_SIZE - 1, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
cdbe3504 MT	437	OVPNNAT, transfer_subnet_address, local_subnet_address);
	438	executeCommand(command);
	439	}
91a0a221 MT	440	}
91a0a221 MT	441
6925b8ef AF	442	conn = conn->next;
6925b8ef AF	443	}
6e13d0a5 MT	444	}
	445
	446	void stopDaemon(void) {
	447	char command[STRING_SIZE];
	448
2bcff894	449	int pid = readPidFile("/var/run/openvpn.pid");
80ca8bd0	450	if (!pid > 0) {
2bcff894 MT	451	exit(1);
	452	}
	453
	454	fprintf(stderr, "Killing PID %d.\n", pid);
	455	kill(pid, SIGTERM);
	456
6e13d0a5 MT	457	snprintf(command, STRING_SIZE - 1, "/bin/rm -f /var/run/openvpn.pid");
	458	executeCommand(command);
	459	}
	460
	461	void startDaemon(void) {
	462	char command[STRING_SIZE];
	463
3ad23ee1	464	if (!((strcmp(enablered, "on") == 0) \|\| (strcmp(enableblue, "on") == 0) \|\| (strcmp(enableorange, "on") == 0))) {
6e13d0a5 MT	465	fprintf(stderr, "OpenVPN is not enabled on any interface\n");
	466	exit(1);
	467	} else {
7d3af7f7 MT	468	snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
7d3af7f7 MT	469	executeCommand(command);
072cd997	470	snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config /var/ipfire/ovpn/server.conf");
6e13d0a5 MT	471	executeCommand(command);
	472	}
	473	}
	474
99b01b84	475	int startNet2Net(char *name) {
6925b8ef AF	476	connection *conn = NULL;
	477	connection *conn_iter;
	478
	479	conn_iter = getConnections();
	480
	481	while (conn_iter) {
91a0a221	482	if ((strcmp(conn_iter->type, "net") == 0) && (strcmp(conn_iter->name, name) == 0)) {
6925b8ef AF	483	conn = conn_iter;
	484	break;
	485	}
	486	conn_iter = conn_iter->next;
	487	}
	488
	489	if (conn == NULL) {
	490	fprintf(stderr, "Connection not found.\n");
99b01b84 MT	491	return 1;
	492	}
	493
	494	if (strcmp(conn->status, "on") != 0) {
	495	fprintf(stderr, "Connection '%s' is not enabled.\n", conn->name);
	496	return 1;
6925b8ef AF	497	}
6925b8ef AF	498
99b01b84 MT	499	fprintf(stderr, "Starting connection %s...\n", conn->name);
99b01b84 MT	500
39877197 MT	501	char configfile[STRING_SIZE];
	502	snprintf(configfile, STRING_SIZE - 1, CONFIG_ROOT "/ovpn/n2nconf/%s/%s.conf",
	503	conn->name, conn->name);
	504
	505	FILE *fp = fopen(configfile, "r");
	506	if (fp == NULL) {
	507	fprintf(stderr, "Could not find configuration file for connection '%s' at '%s'.\n",
	508	conn->name, configfile);
99b01b84	509	return 2;
39877197 MT	510	}
	511	fclose(fp);
	512
07081137 MT	513	// Make sure all firewall rules are up to date.
	514	setFirewallRules();
	515
e1a51ebb SS	516	// Get the external IP address.
	517	char address[STRING_SIZE] = "";
	518	int r = readExternalAddress(address);
	519	if (r) {
	520	fprintf(stderr, "Could not read the external address\n");
	521	exit(1);
	522	}
	523
6925b8ef	524	char command[STRING_SIZE];
81a789d9 MT	525	snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
81a789d9 MT	526	executeCommand(command);
e1a51ebb	527	snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --local %s --config %s", address, configfile);
6925b8ef	528	executeCommand(command);
99b01b84 MT	529
99b01b84 MT	530	return 0;
6925b8ef AF	531	}
6925b8ef AF	532
99b01b84	533	int killNet2Net(char *name) {
39877197 MT	534	connection *conn = NULL;
	535	connection *conn_iter;
	536
	537	conn_iter = getConnections();
	538
	539	while (conn_iter) {
	540	if (strcmp(conn_iter->name, name) == 0) {
	541	conn = conn_iter;
	542	break;
	543	}
	544	conn_iter = conn_iter->next;
	545	}
	546
	547	if (conn == NULL) {
	548	fprintf(stderr, "Connection not found.\n");
99b01b84	549	return 1;
39877197 MT	550	}
	551
	552	char pidfile[STRING_SIZE];
80ca8bd0	553	snprintf(pidfile, STRING_SIZE - 1, "/var/run/%sn2n.pid", conn->name);
39877197	554
2bcff894	555	int pid = readPidFile(pidfile);
80ca8bd0	556	if (!pid > 0) {
99b01b84 MT	557	fprintf(stderr, "Could not read pid file of connection %s.", conn->name);
99b01b84 MT	558	return 1;
39877197 MT	559	}
39877197 MT	560
99b01b84	561	fprintf(stderr, "Killing connection %s (PID %d)...\n", conn->name, pid);
39877197 MT	562	kill(pid, SIGTERM);
39877197 MT	563
d4c8b6be MT	564	char command[STRING_SIZE];
	565	snprintf(command, STRING_SIZE - 1, "/bin/rm -f %s", pidfile);
	566	executeCommand(command);
	567
99b01b84	568	return 0;
6925b8ef AF	569	}
6925b8ef AF	570
5795fc1b AM	571	int deleterrd(char *name) {
	572	connection *conn = getConnections();
	573
	574	char rrd_file[STRING_SIZE];
	575	snprintf(rrd_file, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s/if_octets.rrd", name);
	576
	577	char rrd_dir[STRING_SIZE];
	578	snprintf(rrd_dir, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s", name);
	579
	580	while(conn) {
	581	/* Find only RW-Connections with the given name. */
	582	if (((strcmp(conn->type, "host") == 0) && (strcmp(conn->name, name) == 0))) {
	583	remove(rrd_file);
	584	remove(rrd_dir);
	585	return 0;
	586	}
	587	conn = conn->next;
	588	}
	589
	590	return 1;
	591	}
	592
64f0c354	593	void startAllNet2Net() {
99b01b84 MT	594	int exitcode = 0, _exitcode = 0;
99b01b84 MT	595
64f0c354 MT	596	connection *conn = getConnections();
	597
	598	while(conn) {
99b01b84 MT	599	/* Skip all connections that are not of type "net" or disabled. */
	600	if ((strcmp(conn->type, "net") != 0) \|\| (strcmp(conn->status, "on") != 0)) {
	601	conn = conn->next;
	602	continue;
	603	}
	604
	605	_exitcode = startNet2Net(conn->name);
64f0c354	606	conn = conn->next;
99b01b84 MT	607
	608	if (_exitcode > exitcode) {
	609	exitcode = _exitcode;
	610	}
64f0c354 MT	611	}
64f0c354 MT	612
99b01b84	613	exit(exitcode);
64f0c354 MT	614	}
	615
	616	void killAllNet2Net() {
99b01b84 MT	617	int exitcode = 0, _exitcode = 0;
99b01b84 MT	618
64f0c354 MT	619	connection *conn = getConnections();
	620
	621	while(conn) {
99b01b84 MT	622	/* Skip all connections that are not of type "net". */
	623	if (strcmp(conn->type, "net") != 0) {
	624	conn = conn->next;
	625	continue;
	626	}
	627
	628	_exitcode = killNet2Net(conn->name);
64f0c354	629	conn = conn->next;
99b01b84 MT	630
	631	if (_exitcode > exitcode) {
	632	exitcode = _exitcode;
	633	}
64f0c354 MT	634	}
64f0c354 MT	635
99b01b84	636	exit(exitcode);
64f0c354 MT	637	}
64f0c354 MT	638
6e13d0a5 MT	639	void displayopenvpn(void) {
	640	char command[STRING_SIZE];
	641
	642	snprintf(command, STRING_SIZE - 1, "/bin/killall -sSIGUSR2 openvpn");
	643	executeCommand(command);
	644	}
	645
	646	int main(int argc, char *argv[]) {
	647	if (!(initsetuid()))
	648	exit(1);
	649	if(argc < 2)
	650	usage();
6925b8ef AF	651
6925b8ef AF	652	if(argc == 3) {
91a0a221 MT	653	ovpnInit();
91a0a221 MT	654
6925b8ef AF	655	if( (strcmp(argv[1], "-sn2n") == 0) \|\| (strcmp(argv[1], "--start-net-2-net") == 0) ) {
	656	startNet2Net(argv[2]);
	657	return 0;
	658	}
	659	else if( (strcmp(argv[1], "-kn2n") == 0) \|\| (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
	660	killNet2Net(argv[2]);
	661	return 0;
5795fc1b AM	662	}
	663	else if( (strcmp(argv[1], "-drrd") == 0) \|\| (strcmp(argv[1], "--delete-rrd") == 0) ) {
	664	deleterrd(argv[2]);
	665	return 0;
6925b8ef AF	666	} else {
	667	usage();
	668	return 1;
	669	}
	670	}
	671	else if(argc == 2) {
6e13d0a5 MT	672	if( (strcmp(argv[1], "-k") == 0) \|\| (strcmp(argv[1], "--kill") == 0) ) {
	673	stopDaemon();
	674	return 0;
	675	}
	676	else if( (strcmp(argv[1], "-d") == 0) \|\| (strcmp(argv[1], "--display") == 0) ) {
	677	displayopenvpn();
	678	return 0;
	679	}
6e13d0a5 MT	680	else {
	681	ovpnInit();
	682
	683	if( (strcmp(argv[1], "-s") == 0) \|\| (strcmp(argv[1], "--start") == 0) ) {
6e13d0a5 MT	684	setFirewallRules();
	685	startDaemon();
	686	return 0;
	687	}
64f0c354 MT	688	else if( (strcmp(argv[1], "-sn2n") == 0) \|\| (strcmp(argv[1], "--start-net-2-net") == 0) ) {
	689	startAllNet2Net();
	690	return 0;
	691	}
	692	else if( (strcmp(argv[1], "-kn2n") == 0) \|\| (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
	693	killAllNet2Net();
	694	return 0;
	695	}
6e13d0a5 MT	696	else if( (strcmp(argv[1], "-sdo") == 0) \|\| (strcmp(argv[1], "--start-daemon-only") == 0) ) {
	697	startDaemon();
	698	return 0;
	699	}
	700	else if( (strcmp(argv[1], "-r") == 0) \|\| (strcmp(argv[1], "--restart") == 0) ) {
	701	stopDaemon();
6e13d0a5 MT	702	setFirewallRules();
	703	startDaemon();
	704	return 0;
	705	}
	706	else if( (strcmp(argv[1], "-fwr") == 0) \|\| (strcmp(argv[1], "--firewall-rules") == 0) ) {
6e13d0a5 MT	707	setFirewallRules();
	708	return 0;
	709	}
	710	else {
	711	usage();
	712	return 0;
	713	}
	714	}
	715	}
	716	else {
	717	usage();
	718	return 0;
	719	}
	720	return 0;
	721	}
	722