general-functions.pl: Add formatBytes() function.
[ipfire-2.x.git] / src / misc-progs / openvpnctrl.c
1 #define _XOPEN_SOURCE 500
2 #include <signal.h>
3 #include <stdio.h>
4 #include <string.h>
5 #include <unistd.h>
6 #include <stdlib.h>
7 #include <sys/types.h>
8 #include <arpa/inet.h>
9 #include <netinet/in.h>
10 #include <fcntl.h>
11 #include <ftw.h>
12 #include "setuid.h"
13 #include "netutil.h"
14 #include "libsmooth.h"
15
16 #define noovpndebug
17
18 // global vars
19 struct keyvalue *kv = NULL;
20 FILE *ifacefile = NULL;
21
22 char redif[STRING_SIZE];
23 char blueif[STRING_SIZE];
24 char orangeif[STRING_SIZE];
25 char enablered[STRING_SIZE] = "off";
26 char enableblue[STRING_SIZE] = "off";
27 char enableorange[STRING_SIZE] = "off";
28
29 // consts
30 char OVPNINPUT[STRING_SIZE] = "OVPNINPUT";
31 char OVPNBLOCK[STRING_SIZE] = "OVPNBLOCK";
32 char OVPNNAT[STRING_SIZE] = "OVPNNAT";
33 char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.4";
34
35 struct connection_struct {
36 char name[STRING_SIZE];
37 char type[STRING_SIZE];
38 char proto[STRING_SIZE];
39 char status[STRING_SIZE];
40 char local_subnet[STRING_SIZE];
41 char transfer_subnet[STRING_SIZE];
42 char role[STRING_SIZE];
43 char port[STRING_SIZE];
44 struct connection_struct *next;
45 };
46
47 typedef struct connection_struct connection;
48
49 static int recursive_remove_callback(const char* fpath, const struct stat* sb, int typeflag, struct FTW* ftwbuf) {
50 int rv = remove(fpath);
51 if (rv)
52 perror(fpath);
53
54 return rv;
55 }
56
57 static int recursive_remove(const char* path) {
58 return nftw(path, recursive_remove_callback, 64, FTW_DEPTH | FTW_PHYS);
59 }
60
61 void exithandler(void)
62 {
63 if(kv)
64 freekeyvalues(kv);
65 if (ifacefile)
66 fclose(ifacefile);
67 }
68
69 void usage(void)
70 {
71 #ifdef ovpndebug
72 printf("Wrapper for OpenVPN %s-debug\n", WRAPPERVERSION);
73 #else
74 printf("Wrapper for OpenVPN %s\n", WRAPPERVERSION);
75 #endif
76 printf("openvpnctrl <option>\n");
77 printf(" Valid options are:\n");
78 printf(" -s --start\n");
79 printf(" starts OpenVPN (implicitly creates chains and firewall rules)\n");
80 printf(" -k --kill\n");
81 printf(" kills/stops OpenVPN\n");
82 printf(" -r --restart\n");
83 printf(" restarts OpenVPN (implicitly creates chains and firewall rules)\n");
84 printf(" -sn2n --start-net-2-net\n");
85 printf(" starts all net2net connections\n");
86 printf(" you may pass a connection name to the switch to only start a specific one\n");
87 printf(" -kn2n --kill-net-2-net\n");
88 printf(" kills all net2net connections\n");
89 printf(" you may pass a connection name to the switch to only start a specific one\n");
90 printf(" -drrd --delete-rrd\n");
91 printf(" Deletes the RRD data for a specific client\n");
92 printf(" you need to pass a connection name (RW) to the switch to delete the directory (case sensitive)\n");
93 printf(" -d --display\n");
94 printf(" displays OpenVPN status to syslog\n");
95 printf(" -fwr --firewall-rules\n");
96 printf(" removes current OpenVPN chains and rules and resets them according to the config\n");
97 printf(" -sdo --start-daemon-only\n");
98 printf(" starts OpenVPN daemon only\n");
99 exit(1);
100 }
101
102 connection *getConnections() {
103 FILE *fp = NULL;
104
105 if (!(fp = fopen(CONFIG_ROOT "/ovpn/ovpnconfig", "r"))) {
106 fprintf(stderr, "Could not open openvpn n2n configuration file.\n");
107 exit(1);
108 }
109
110 char line[STRING_SIZE] = "";
111 char result[STRING_SIZE] = "";
112 char *resultptr;
113 int count;
114 connection *conn_first = NULL;
115 connection *conn_last = NULL;
116 connection *conn_curr;
117
118 while ((fgets(line, STRING_SIZE, fp) != NULL)) {
119 if (line[strlen(line) - 1] == '\n')
120 line[strlen(line) - 1] = '\0';
121
122 conn_curr = (connection *)malloc(sizeof(connection));
123 memset(conn_curr, 0, sizeof(connection));
124
125 if (conn_first == NULL) {
126 conn_first = conn_curr;
127 } else {
128 conn_last->next = conn_curr;
129 }
130 conn_last = conn_curr;
131
132 count = 0;
133 char *lineptr = &line;
134 while (1) {
135 if (*lineptr == NULL)
136 break;
137
138 resultptr = result;
139 while (*lineptr != NULL) {
140 if (*lineptr == ',') {
141 lineptr++;
142 break;
143 }
144 *resultptr++ = *lineptr++;
145 }
146 *resultptr = '\0';
147
148 if (count == 1) {
149 strcpy(conn_curr->status, result);
150 } else if (count == 2) {
151 strcpy(conn_curr->name, result);
152 } else if (count == 4) {
153 strcpy(conn_curr->type, result);
154 } else if (count == 7) {
155 strcpy(conn_curr->role, result);
156 } else if (count == 9) {
157 strcpy(conn_curr->local_subnet, result);
158 } else if (count == 28) {
159 strcpy(conn_curr->transfer_subnet, result);
160 } else if (count == 29) {
161 strcpy(conn_curr->proto, result);
162 } else if (count == 30) {
163 strcpy(conn_curr->port, result);
164 }
165
166 count++;
167 }
168 }
169
170 fclose(fp);
171
172 return conn_first;
173 }
174
175 int readPidFile(const char *pidfile) {
176 FILE *fp = fopen(pidfile, "r");
177 if (fp == NULL) {
178 exit(1);
179 }
180
181 int pid = 0;
182 fscanf(fp, "%d", &pid);
183 fclose(fp);
184
185 return pid;
186 }
187
188 int readExternalAddress(char* address) {
189 FILE *fp = fopen("/var/ipfire/red/local-ipaddress", "r");
190 if (!fp)
191 goto ERROR;
192
193 int r = fscanf(fp, "%s", address);
194 fclose(fp);
195
196 if (r < 0)
197 goto ERROR;
198
199 /* In case the read IP address is not valid, we empty
200 * the content of address and return non-zero. */
201 if (!VALID_IP(address))
202 goto ERROR;
203
204 return 0;
205
206 ERROR:
207 address = NULL;
208 return 1;
209 }
210
211 void ovpnInit(void) {
212 // Read OpenVPN configuration
213 kv = initkeyvalues();
214 if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings")) {
215 fprintf(stderr, "Cannot read ovpn settings\n");
216 exit(1);
217 }
218
219 if (!findkey(kv, "ENABLED", enablered)) {
220 exit(1);
221 }
222
223 if (!findkey(kv, "ENABLED_BLUE", enableblue)){
224 exit(1);
225 }
226
227 if (!findkey(kv, "ENABLED_ORANGE", enableorange)){
228 exit(1);
229 }
230 freekeyvalues(kv);
231
232 // read interface settings
233
234 // details for the red int
235 memset(redif, 0, STRING_SIZE);
236 if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r")))
237 {
238 if (fgets(redif, STRING_SIZE, ifacefile))
239 {
240 if (redif[strlen(redif) - 1] == '\n')
241 redif[strlen(redif) - 1] = '\0';
242 }
243 fclose (ifacefile);
244 ifacefile = NULL;
245
246 if (!VALID_DEVICE(redif))
247 {
248 memset(redif, 0, STRING_SIZE);
249 }
250 }
251
252 kv=initkeyvalues();
253 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
254 fprintf(stderr, "Cannot read ethernet settings\n");
255 exit(1);
256 }
257
258 if (strcmp(enableblue, "on") == 0) {
259 if (!findkey(kv, "BLUE_DEV", blueif)) {
260 exit(1);
261 }
262 }
263
264 if (strcmp(enableorange, "on") == 0) {
265 if (!findkey(kv, "ORANGE_DEV", orangeif)) {
266 exit(1);
267 }
268 }
269 freekeyvalues(kv);
270 }
271
272 void executeCommand(char *command) {
273 #ifdef ovpndebug
274 printf(strncat(command, "\n", 2));
275 #endif
276 safe_system(strncat(command, " >/dev/null 2>&1", 17));
277 }
278
279 void addRule(const char *chain, const char *interface, const char *protocol, const char *port) {
280 char command[STRING_SIZE];
281
282 snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -i %s -p %s --dport %s -j ACCEPT",
283 chain, interface, protocol, port);
284 executeCommand(command);
285 }
286
287 void flushChain(char *chain) {
288 char str[STRING_SIZE];
289
290 snprintf(str, STRING_SIZE - 1, "/sbin/iptables -F %s", chain);
291 executeCommand(str);
292 }
293
294 void flushChainNAT(char *chain) {
295 char str[STRING_SIZE];
296
297 snprintf(str, STRING_SIZE - 1, "/sbin/iptables -t nat -F %s", chain);
298 executeCommand(str);
299 }
300
301 char* calcTransferNetAddress(const connection* conn) {
302 char *subnetmask = strdup(conn->transfer_subnet);
303 char *address = strsep(&subnetmask, "/");
304
305 if ((address == NULL) || (subnetmask == NULL)) {
306 goto ERROR;
307 }
308
309 in_addr_t _address = inet_addr(address);
310 in_addr_t _subnetmask = inet_addr(subnetmask);
311 _address &= _subnetmask;
312
313 if (strcmp(conn->role, "server") == 0) {
314 _address += 1 << 24;
315 } else if (strcmp(conn->role, "client") == 0) {
316 _address += 2 << 24;
317 } else {
318 goto ERROR;
319 }
320
321 struct in_addr address_info;
322 address_info.s_addr = _address;
323
324 return inet_ntoa(address_info);
325
326 ERROR:
327 fprintf(stderr, "Could not determine transfer net address: %s\n", conn->name);
328
329 free(address);
330 return NULL;
331 }
332
333 char* getLocalSubnetAddress(const connection* conn) {
334 kv = initkeyvalues();
335 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
336 fprintf(stderr, "Cannot read ethernet settings\n");
337 exit(1);
338 }
339
340 const char *zones[] = {"GREEN", "BLUE", "ORANGE", NULL};
341 char *zone = NULL;
342
343 // Get net address of the local openvpn subnet.
344 char *subnetmask = strdup(conn->local_subnet);
345 char *address = strsep(&subnetmask, "/");
346
347 if ((address == NULL) || (subnetmask == NULL)) {
348 goto ERROR;
349 }
350
351 in_addr_t _address = inet_addr(address);
352 in_addr_t _subnetmask = inet_addr(subnetmask);
353
354 in_addr_t _netaddr = (_address & _subnetmask);
355 in_addr_t _broadcast = (_address | ~_subnetmask);
356
357 char zone_address_key[STRING_SIZE];
358 char zone_address[STRING_SIZE];
359 in_addr_t zone_addr;
360
361 int i = 0;
362 while (zones[i]) {
363 zone = zones[i++];
364 snprintf(zone_address_key, STRING_SIZE, "%s_ADDRESS", zone);
365
366 if (!findkey(kv, zone_address_key, zone_address))
367 continue;
368
369 zone_addr = inet_addr(zone_address);
370 if ((zone_addr > _netaddr) && (zone_addr < _broadcast)) {
371 freekeyvalues(kv);
372
373 return strdup(zone_address);
374 }
375 }
376
377 ERROR:
378 fprintf(stderr, "Could not determine local subnet address: %s\n", conn->name);
379
380 freekeyvalues(kv);
381 return NULL;
382 }
383
384 void setFirewallRules(void) {
385 char command[STRING_SIZE];
386 char protocol[STRING_SIZE] = "";
387 char dport[STRING_SIZE] = "";
388 char dovpnip[STRING_SIZE] = "";
389
390 kv = initkeyvalues();
391 if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings"))
392 {
393 fprintf(stderr, "Cannot read ovpn settings\n");
394 exit(1);
395 }
396
397 /* we got one device, so lets proceed further */
398 if (!findkey(kv, "DDEST_PORT", dport)){
399 fprintf(stderr, "Cannot read DDEST_PORT\n");
400 exit(1);
401 }
402
403 if (!findkey(kv, "DPROTOCOL", protocol)){
404 fprintf(stderr, "Cannot read DPROTOCOL\n");
405 exit(1);
406 }
407
408 if (!findkey(kv, "VPN_IP", dovpnip)){
409 fprintf(stderr, "Cannot read VPN_IP\n");
410 }
411 freekeyvalues(kv);
412
413 // Flush all chains.
414 flushChain(OVPNINPUT);
415 flushChain(OVPNBLOCK);
416 flushChainNAT(OVPNNAT);
417
418 // set firewall rules
419 if (!strcmp(enablered, "on") && strlen(redif))
420 addRule(OVPNINPUT, redif, protocol, dport);
421 if (!strcmp(enableblue, "on") && strlen(blueif))
422 addRule(OVPNINPUT, blueif, protocol, dport);
423 if (!strcmp(enableorange, "on") && strlen(orangeif))
424 addRule(OVPNINPUT, orangeif, protocol, dport);
425
426 /* Allow ICMP error messages to pass. */
427 snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -p icmp"
428 " -m conntrack --ctstate RELATED -j RETURN", OVPNBLOCK);
429 executeCommand(command);
430
431 // read connection configuration
432 connection *conn = getConnections();
433
434 // set firewall rules for n2n connections
435 char *local_subnet_address = NULL;
436 char *transfer_subnet_address = NULL;
437 while (conn != NULL) {
438 if (strcmp(conn->type, "net") == 0) {
439 addRule(OVPNINPUT, redif, conn->proto, conn->port);
440
441 /* Block all communication from the transfer nets. */
442 snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -s %s -j DROP",
443 OVPNBLOCK, conn->transfer_subnet);
444 executeCommand(command);
445
446 local_subnet_address = getLocalSubnetAddress(conn);
447 transfer_subnet_address = calcTransferNetAddress(conn);
448
449 if ((local_subnet_address) && (transfer_subnet_address)) {
450 snprintf(command, STRING_SIZE - 1, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
451 OVPNNAT, transfer_subnet_address, local_subnet_address);
452 executeCommand(command);
453 }
454 }
455
456 conn = conn->next;
457 }
458 }
459
460 void stopDaemon(void) {
461 char command[STRING_SIZE];
462
463 int pid = readPidFile("/var/run/openvpn.pid");
464 if (!pid > 0) {
465 exit(1);
466 }
467
468 fprintf(stderr, "Killing PID %d.\n", pid);
469 kill(pid, SIGTERM);
470
471 snprintf(command, STRING_SIZE - 1, "/bin/rm -f /var/run/openvpn.pid");
472 executeCommand(command);
473 }
474
475 void startDaemon(void) {
476 char command[STRING_SIZE];
477
478 if (!((strcmp(enablered, "on") == 0) || (strcmp(enableblue, "on") == 0) || (strcmp(enableorange, "on") == 0))) {
479 fprintf(stderr, "OpenVPN is not enabled on any interface\n");
480 exit(1);
481 } else {
482 snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
483 executeCommand(command);
484 snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config /var/ipfire/ovpn/server.conf");
485 executeCommand(command);
486 snprintf(command, STRING_SIZE-1, "/bin/chown root.nobody /var/run/ovpnserver.log");
487 executeCommand(command);
488 snprintf(command, STRING_SIZE-1, "/bin/chmod 644 /var/run/ovpnserver.log");
489 executeCommand(command);
490 }
491 }
492
493 int startNet2Net(char *name) {
494 connection *conn = NULL;
495 connection *conn_iter;
496
497 conn_iter = getConnections();
498
499 while (conn_iter) {
500 if ((strcmp(conn_iter->type, "net") == 0) && (strcmp(conn_iter->name, name) == 0)) {
501 conn = conn_iter;
502 break;
503 }
504 conn_iter = conn_iter->next;
505 }
506
507 if (conn == NULL) {
508 fprintf(stderr, "Connection not found.\n");
509 return 1;
510 }
511
512 if (strcmp(conn->status, "on") != 0) {
513 fprintf(stderr, "Connection '%s' is not enabled.\n", conn->name);
514 return 1;
515 }
516
517 fprintf(stderr, "Starting connection %s...\n", conn->name);
518
519 char configfile[STRING_SIZE];
520 snprintf(configfile, STRING_SIZE - 1, CONFIG_ROOT "/ovpn/n2nconf/%s/%s.conf",
521 conn->name, conn->name);
522
523 FILE *fp = fopen(configfile, "r");
524 if (fp == NULL) {
525 fprintf(stderr, "Could not find configuration file for connection '%s' at '%s'.\n",
526 conn->name, configfile);
527 return 2;
528 }
529 fclose(fp);
530
531 // Make sure all firewall rules are up to date.
532 setFirewallRules();
533
534 // Get the external IP address.
535 char address[STRING_SIZE] = "";
536 int r = readExternalAddress(address);
537 if (r) {
538 fprintf(stderr, "Could not read the external address\n");
539 exit(1);
540 }
541
542 char command[STRING_SIZE];
543 snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
544 executeCommand(command);
545 snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --local %s --config %s", address, configfile);
546 executeCommand(command);
547
548 return 0;
549 }
550
551 int killNet2Net(char *name) {
552 connection *conn = NULL;
553 connection *conn_iter;
554 int rc = 0;
555
556 conn_iter = getConnections();
557
558 while (conn_iter) {
559 if (strcmp(conn_iter->name, name) == 0) {
560 conn = conn_iter;
561 break;
562 }
563 conn_iter = conn_iter->next;
564 }
565
566 if (conn == NULL) {
567 fprintf(stderr, "Connection not found.\n");
568 return 1;
569 }
570
571 char pidfile[STRING_SIZE];
572 snprintf(pidfile, STRING_SIZE - 1, "/var/run/%sn2n.pid", conn->name);
573
574 int pid = readPidFile(pidfile);
575 if (!pid > 0) {
576 fprintf(stderr, "Could not read pid file of connection %s.", conn->name);
577 return 1;
578 }
579
580 fprintf(stderr, "Killing connection %s (PID %d)...\n", conn->name, pid);
581 kill(pid, SIGTERM);
582
583 char command[STRING_SIZE];
584 snprintf(command, STRING_SIZE - 1, "/bin/rm -f %s", pidfile);
585 executeCommand(command);
586
587 char runfile[STRING_SIZE];
588 snprintf(runfile, STRING_SIZE - 1, "/var/run/openvpn/%s-n2n", conn->name);
589 rc = recursive_remove(runfile);
590 if (rc)
591 perror(runfile);
592
593 return 0;
594 }
595
596 int deleterrd(char *name) {
597 char rrd_dir[STRING_SIZE];
598
599 connection *conn = getConnections();
600 while(conn) {
601 if (strcmp(conn->name, name) != 0) {
602 conn = conn->next;
603 continue;
604 }
605
606 // Handle RW connections
607 if (strcmp(conn->type, "host") == 0) {
608 snprintf(rrd_dir, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s/", name);
609
610 // Handle N2N connections
611 } else if (strcmp(conn->type, "net") == 0) {
612 snprintf(rrd_dir, STRING_SIZE - 1, "/var/log/rrd/collectd/localhost/openvpn-%s-n2n/", name);
613
614 // Unhandled connection type
615 } else {
616 conn = conn->next;
617 continue;
618 }
619
620 return recursive_remove(rrd_dir);
621 }
622
623 return 1;
624 }
625
626 void startAllNet2Net() {
627 int exitcode = 0, _exitcode = 0;
628
629 connection *conn = getConnections();
630
631 while(conn) {
632 /* Skip all connections that are not of type "net" or disabled. */
633 if ((strcmp(conn->type, "net") != 0) || (strcmp(conn->status, "on") != 0)) {
634 conn = conn->next;
635 continue;
636 }
637
638 _exitcode = startNet2Net(conn->name);
639 conn = conn->next;
640
641 if (_exitcode > exitcode) {
642 exitcode = _exitcode;
643 }
644 }
645
646 exit(exitcode);
647 }
648
649 void killAllNet2Net() {
650 int exitcode = 0, _exitcode = 0;
651
652 connection *conn = getConnections();
653
654 while(conn) {
655 /* Skip all connections that are not of type "net". */
656 if (strcmp(conn->type, "net") != 0) {
657 conn = conn->next;
658 continue;
659 }
660
661 _exitcode = killNet2Net(conn->name);
662 conn = conn->next;
663
664 if (_exitcode > exitcode) {
665 exitcode = _exitcode;
666 }
667 }
668
669 exit(exitcode);
670 }
671
672 void displayopenvpn(void) {
673 char command[STRING_SIZE];
674
675 snprintf(command, STRING_SIZE - 1, "/bin/killall -sSIGUSR2 openvpn");
676 executeCommand(command);
677 }
678
679 int main(int argc, char *argv[]) {
680 if (!(initsetuid()))
681 exit(1);
682 if(argc < 2)
683 usage();
684
685 if(argc == 3) {
686 ovpnInit();
687
688 if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
689 startNet2Net(argv[2]);
690 return 0;
691 }
692 else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
693 killNet2Net(argv[2]);
694 return 0;
695 }
696 else if( (strcmp(argv[1], "-drrd") == 0) || (strcmp(argv[1], "--delete-rrd") == 0) ) {
697 deleterrd(argv[2]);
698 return 0;
699 } else {
700 usage();
701 return 1;
702 }
703 }
704 else if(argc == 2) {
705 if( (strcmp(argv[1], "-k") == 0) || (strcmp(argv[1], "--kill") == 0) ) {
706 stopDaemon();
707 return 0;
708 }
709 else if( (strcmp(argv[1], "-d") == 0) || (strcmp(argv[1], "--display") == 0) ) {
710 displayopenvpn();
711 return 0;
712 }
713 else {
714 ovpnInit();
715
716 if( (strcmp(argv[1], "-s") == 0) || (strcmp(argv[1], "--start") == 0) ) {
717 setFirewallRules();
718 startDaemon();
719 return 0;
720 }
721 else if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
722 startAllNet2Net();
723 return 0;
724 }
725 else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
726 killAllNet2Net();
727 return 0;
728 }
729 else if( (strcmp(argv[1], "-sdo") == 0) || (strcmp(argv[1], "--start-daemon-only") == 0) ) {
730 startDaemon();
731 return 0;
732 }
733 else if( (strcmp(argv[1], "-r") == 0) || (strcmp(argv[1], "--restart") == 0) ) {
734 stopDaemon();
735 setFirewallRules();
736 startDaemon();
737 return 0;
738 }
739 else if( (strcmp(argv[1], "-fwr") == 0) || (strcmp(argv[1], "--firewall-rules") == 0) ) {
740 setFirewallRules();
741 return 0;
742 }
743 else {
744 usage();
745 return 0;
746 }
747 }
748 }
749 else {
750 usage();
751 return 0;
752 }
753 return 0;
754 }
755