14 struct keyvalue
*kv
= NULL
;
15 FILE *ifacefile
= NULL
;
17 char redif
[STRING_SIZE
];
18 char blueif
[STRING_SIZE
];
19 char orangeif
[STRING_SIZE
];
20 char enablered
[STRING_SIZE
] = "off";
21 char enableblue
[STRING_SIZE
] = "off";
22 char enableorange
[STRING_SIZE
] = "off";
25 char OVPNRED
[STRING_SIZE
] = "OVPN";
26 char OVPNBLUE
[STRING_SIZE
] = "OVPN_BLUE_";
27 char OVPNORANGE
[STRING_SIZE
] = "OVPN_ORANGE_";
28 char WRAPPERVERSION
[STRING_SIZE
] = "ipfire-2.2.1";
30 struct connection_struct
{
31 char name
[STRING_SIZE
];
32 char type
[STRING_SIZE
];
33 char proto
[STRING_SIZE
];
35 struct connection_struct
*next
;
38 typedef struct connection_struct connection
;
40 void exithandler(void)
51 printf("Wrapper for OpenVPN %s-debug\n", WRAPPERVERSION
);
53 printf("Wrapper for OpenVPN %s\n", WRAPPERVERSION
);
55 printf("openvpnctrl <option>\n");
56 printf(" Valid options are:\n");
57 printf(" -s --start\n");
58 printf(" starts OpenVPN (implicitly creates chains and firewall rules)\n");
59 printf(" -k --kill\n");
60 printf(" kills/stops OpenVPN\n");
61 printf(" -r --restart\n");
62 printf(" restarts OpenVPN (implicitly creates chains and firewall rules)\n");
63 printf(" -sn2n --start-net-2-net\n");
64 printf(" starts all net2net connections\n");
65 printf(" you may pass a connection name to the switch to only start a specific one\n");
66 printf(" -kn2n --kill-net-2-net\n");
67 printf(" kills all net2net connections\n");
68 printf(" you may pass a connection name to the switch to only start a specific one\n");
69 printf(" -d --display\n");
70 printf(" displays OpenVPN status to syslog\n");
71 printf(" -fwr --firewall-rules\n");
72 printf(" removes current OpenVPN chains and rules and resets them according to the config\n");
73 printf(" -sdo --start-daemon-only\n");
74 printf(" starts OpenVPN daemon only\n");
75 printf(" -ccr --create-chains-and-rules\n");
76 printf(" creates chains and rules for OpenVPN\n");
77 printf(" -dcr --delete-chains-and-rules\n");
78 printf(" removes all chains for OpenVPN\n");
82 connection
*getConnections() {
85 if (!(fp
= fopen(CONFIG_ROOT
"/ovpn/ovpnconfig", "r"))) {
86 fprintf(stderr
, "Could not open openvpn n2n configuration file.\n");
90 char line
[STRING_SIZE
] = "";
91 char result
[STRING_SIZE
] = "";
94 connection
*conn_first
= NULL
;
95 connection
*conn_last
= NULL
;
96 connection
*conn_curr
;
98 while ((fgets(line
, STRING_SIZE
, fp
) != NULL
)) {
99 if (line
[strlen(line
) - 1] == '\n')
100 line
[strlen(line
) - 1] = '\0';
102 conn_curr
= (connection
*)malloc(sizeof(connection
));
103 memset(conn_curr
, 0, sizeof(connection
));
105 if (conn_first
== NULL
) {
106 conn_first
= conn_curr
;
108 conn_last
->next
= conn_curr
;
110 conn_last
= conn_curr
;
113 char *lineptr
= &line
;
115 if (*lineptr
== NULL
)
119 while (*lineptr
!= NULL
) {
120 if (*lineptr
== ',') {
124 *resultptr
++ = *lineptr
++;
129 strcpy(conn_curr
->name
, result
);
130 } else if (count
== 4) {
131 strcpy(conn_curr
->type
, result
);
132 } else if (count
== 29) {
133 strcpy(conn_curr
->proto
, result
);
134 } else if (count
== 30) {
135 conn_curr
->port
= atoi(result
);
147 int readPidFile(const char *pidfile
) {
148 FILE *fp
= fopen(pidfile
, "r");
150 fprintf(stderr
, "PID file not found: '%s'\n", pidfile
);
155 fscanf(fp
, "%d", &pid
);
161 void ovpnInit(void) {
163 // Read OpenVPN configuration
164 kv
= initkeyvalues();
165 if (!readkeyvalues(kv
, CONFIG_ROOT
"/ovpn/settings")) {
166 fprintf(stderr
, "Cannot read ovpn settings\n");
170 if (!findkey(kv
, "ENABLED", enablered
)) {
171 fprintf(stderr
, "Cannot read ENABLED\n");
175 if (!findkey(kv
, "ENABLED_BLUE", enableblue
)){
176 fprintf(stderr
, "Cannot read ENABLED_BLUE\n");
180 if (!findkey(kv
, "ENABLED_ORANGE", enableorange
)){
181 fprintf(stderr
, "Cannot read ENABLED_ORANGE\n");
186 // read interface settings
188 // details for the red int
189 memset(redif
, 0, STRING_SIZE
);
190 if ((ifacefile
= fopen(CONFIG_ROOT
"/red/iface", "r")))
192 if (fgets(redif
, STRING_SIZE
, ifacefile
))
194 if (redif
[strlen(redif
) - 1] == '\n')
195 redif
[strlen(redif
) - 1] = '\0';
200 if (!VALID_DEVICE(redif
))
202 memset(redif
, 0, STRING_SIZE
);
207 if (!readkeyvalues(kv
, CONFIG_ROOT
"/ethernet/settings"))
209 fprintf(stderr
, "Cannot read ethernet settings\n");
213 if (strcmp(enableblue
, "on")==0){
214 if (!findkey(kv
, "BLUE_DEV", blueif
)){
215 fprintf(stderr
, "Cannot read BLUE_DEV\n");
219 if (strcmp(enableorange
, "on")==0){
220 if (!findkey(kv
, "ORANGE_DEV", orangeif
)){
221 fprintf(stderr
, "Cannot read ORNAGE_DEV\n");
228 void executeCommand(char *command
) {
230 printf(strncat(command
, "\n", 2));
232 safe_system(strncat(command
, " >/dev/null 2>&1", 17));
235 void setChainRules(char *chain
, char *interface
, char *protocol
, char *port
)
237 char str
[STRING_SIZE
];
239 sprintf(str
, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %s -j ACCEPT", chain
, interface
, protocol
, port
);
241 sprintf(str
, "/sbin/iptables -A %sINPUT -i tun+ -j ACCEPT", chain
);
243 sprintf(str
, "/sbin/iptables -A %sFORWARD -i tun+ -j ACCEPT", chain
);
247 void flushChain(char *chain
) {
248 char str
[STRING_SIZE
];
250 sprintf(str
, "/sbin/iptables -F %sINPUT", chain
);
252 sprintf(str
, "/sbin/iptables -F %sFORWARD", chain
);
257 void deleteChainReference(char *chain
) {
258 char str
[STRING_SIZE
];
260 sprintf(str
, "/sbin/iptables -D INPUT -j %sINPUT", chain
);
263 sprintf(str
, "/sbin/iptables -D FORWARD -j %sFORWARD", chain
);
268 void deleteChain(char *chain
) {
269 char str
[STRING_SIZE
];
271 sprintf(str
, "/sbin/iptables -X %sINPUT", chain
);
273 sprintf(str
, "/sbin/iptables -X %sFORWARD", chain
);
277 void deleteAllChains(void) {
278 // not an elegant solution, but to avoid timing problems with undeleted chain references
279 deleteChainReference(OVPNRED
);
280 deleteChainReference(OVPNBLUE
);
281 deleteChainReference(OVPNORANGE
);
283 flushChain(OVPNBLUE
);
284 flushChain(OVPNORANGE
);
285 deleteChain(OVPNRED
);
286 deleteChain(OVPNBLUE
);
287 deleteChain(OVPNORANGE
);
290 void createChainReference(char *chain
) {
291 char str
[STRING_SIZE
];
292 sprintf(str
, "/sbin/iptables -I INPUT %s -j %sINPUT", "14", chain
);
294 sprintf(str
, "/sbin/iptables -I FORWARD %s -j %sFORWARD", "12", chain
);
298 void createChain(char *chain
) {
299 char str
[STRING_SIZE
];
300 sprintf(str
, "/sbin/iptables -N %sINPUT", chain
);
302 sprintf(str
, "/sbin/iptables -N %sFORWARD", chain
);
306 void createAllChains(void) {
307 // create chain and chain references
308 if (!strcmp(enableorange
, "on")) {
309 if (strlen(orangeif
)) {
310 createChain(OVPNORANGE
);
311 createChainReference(OVPNORANGE
);
313 fprintf(stderr
, "OpenVPN enabled on orange but no orange interface found\n");
318 if (!strcmp(enableblue
, "on")) {
319 if (strlen(blueif
)) {
320 createChain(OVPNBLUE
);
321 createChainReference(OVPNBLUE
);
323 fprintf(stderr
, "OpenVPN enabled on blue but no blue interface found\n");
328 if (!strcmp(enablered
, "on")) {
330 createChain(OVPNRED
);
331 createChainReference(OVPNRED
);
333 fprintf(stderr
, "OpenVPN enabled on red but no red interface found\n");
339 void setFirewallRules(void) {
340 char protocol
[STRING_SIZE
] = "";
341 char dport
[STRING_SIZE
] = "";
342 char dovpnip
[STRING_SIZE
] = "";
344 kv
= initkeyvalues();
345 if (!readkeyvalues(kv
, CONFIG_ROOT
"/ovpn/settings"))
347 fprintf(stderr
, "Cannot read ovpn settings\n");
351 /* we got one device, so lets proceed further */
352 if (!findkey(kv
, "DDEST_PORT", dport
)){
353 fprintf(stderr
, "Cannot read DDEST_PORT\n");
357 if (!findkey(kv
, "DPROTOCOL", protocol
)){
358 fprintf(stderr
, "Cannot read DPROTOCOL\n");
362 if (!findkey(kv
, "VPN_IP", dovpnip
)){
363 fprintf(stderr
, "Cannot read VPN_IP\n");
364 // exit(1); step further as we don't need an ip
370 flushChain(OVPNBLUE
);
371 flushChain(OVPNORANGE
);
373 // set firewall rules
374 if (!strcmp(enablered
, "on") && strlen(redif
))
375 setChainRules(OVPNRED
, redif
, protocol
, dport
);
376 if (!strcmp(enableblue
, "on") && strlen(blueif
))
377 setChainRules(OVPNBLUE
, blueif
, protocol
, dport
);
378 if (!strcmp(enableorange
, "on") && strlen(orangeif
))
379 setChainRules(OVPNORANGE
, orangeif
, protocol
, dport
);
381 // read connection configuration
382 connection
*conn
= getConnections();
384 // set firewall rules for n2n connections
385 char command
[STRING_SIZE
];
386 while (conn
!= NULL
) {
387 if (strcmp(conn
->type
, "net") == 0) {
388 sprintf(command
, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %d -j ACCEPT",
389 OVPNRED
, redif
, conn
->proto
, conn
->port
);
390 executeCommand(command
);
397 void stopDaemon(void) {
398 char command
[STRING_SIZE
];
400 int pid
= readPidFile("/var/run/openvpn.pid");
405 fprintf(stderr
, "Killing PID %d.\n", pid
);
408 snprintf(command
, STRING_SIZE
- 1, "/bin/rm -f /var/run/openvpn.pid");
409 executeCommand(command
);
412 void startDaemon(void) {
413 char command
[STRING_SIZE
];
415 if (!((strcmp(enablered
, "on")==0) || (strcmp(enableblue
, "on")==0) || (strcmp(enableorange
, "on")==0))){
416 fprintf(stderr
, "OpenVPN is not enabled on any interface\n");
419 snprintf(command
, STRING_SIZE
-1, "/sbin/modprobe tun");
420 executeCommand(command
);
421 snprintf(command
, STRING_SIZE
-1, "/usr/sbin/openvpn --config /var/ipfire/ovpn/server.conf");
422 executeCommand(command
);
426 void startNet2Net(char *name
) {
427 connection
*conn
= NULL
;
428 connection
*conn_iter
;
430 conn_iter
= getConnections();
433 if ((strcmp(conn_iter
->type
, "net") == 0) && (strcmp(conn_iter
->name
, name
) == 0)) {
437 conn_iter
= conn_iter
->next
;
441 fprintf(stderr
, "Connection not found.\n");
445 char configfile
[STRING_SIZE
];
446 snprintf(configfile
, STRING_SIZE
- 1, CONFIG_ROOT
"/ovpn/n2nconf/%s/%s.conf",
447 conn
->name
, conn
->name
);
449 FILE *fp
= fopen(configfile
, "r");
451 fprintf(stderr
, "Could not find configuration file for connection '%s' at '%s'.\n",
452 conn
->name
, configfile
);
457 // Make sure all firewall rules are up to date.
460 char command
[STRING_SIZE
];
461 snprintf(command
, STRING_SIZE
-1, "/sbin/modprobe tun");
462 executeCommand(command
);
463 snprintf(command
, STRING_SIZE
-1, "/usr/sbin/openvpn --config %s", configfile
);
464 executeCommand(command
);
467 void killNet2Net(char *name
) {
468 connection
*conn
= NULL
;
469 connection
*conn_iter
;
471 conn_iter
= getConnections();
474 if (strcmp(conn_iter
->name
, name
) == 0) {
478 conn_iter
= conn_iter
->next
;
482 fprintf(stderr
, "Connection not found.\n");
486 char pidfile
[STRING_SIZE
];
487 snprintf(pidfile
, STRING_SIZE
- 1, "/var/run/%sn2n.pid", conn
->name
);
489 int pid
= readPidFile(pidfile
);
494 fprintf(stderr
, "Killing PID %d.\n", pid
);
497 char command
[STRING_SIZE
];
498 snprintf(command
, STRING_SIZE
- 1, "/bin/rm -f %s", pidfile
);
499 executeCommand(command
);
504 void startAllNet2Net() {
505 connection
*conn
= getConnections();
508 startNet2Net(conn
->name
);
515 void killAllNet2Net() {
516 connection
*conn
= getConnections();
519 killNet2Net(conn
->name
);
526 void displayopenvpn(void) {
527 char command
[STRING_SIZE
];
529 snprintf(command
, STRING_SIZE
- 1, "/bin/killall -sSIGUSR2 openvpn");
530 executeCommand(command
);
533 int main(int argc
, char *argv
[]) {
542 if( (strcmp(argv
[1], "-sn2n") == 0) || (strcmp(argv
[1], "--start-net-2-net") == 0) ) {
543 startNet2Net(argv
[2]);
546 else if( (strcmp(argv
[1], "-kn2n") == 0) || (strcmp(argv
[1], "--kill-net-2-net") == 0) ) {
547 killNet2Net(argv
[2]);
555 if( (strcmp(argv
[1], "-k") == 0) || (strcmp(argv
[1], "--kill") == 0) ) {
559 else if( (strcmp(argv
[1], "-d") == 0) || (strcmp(argv
[1], "--display") == 0) ) {
563 else if( (strcmp(argv
[1], "-dcr") == 0) || (strcmp(argv
[1], "--delete-chains-and-rules") == 0) ) {
570 if( (strcmp(argv
[1], "-s") == 0) || (strcmp(argv
[1], "--start") == 0) ) {
577 else if( (strcmp(argv
[1], "-sn2n") == 0) || (strcmp(argv
[1], "--start-net-2-net") == 0) ) {
581 else if( (strcmp(argv
[1], "-kn2n") == 0) || (strcmp(argv
[1], "--kill-net-2-net") == 0) ) {
585 else if( (strcmp(argv
[1], "-sdo") == 0) || (strcmp(argv
[1], "--start-daemon-only") == 0) ) {
589 else if( (strcmp(argv
[1], "-r") == 0) || (strcmp(argv
[1], "--restart") == 0) ) {
597 else if( (strcmp(argv
[1], "-fwr") == 0) || (strcmp(argv
[1], "--firewall-rules") == 0) ) {
603 else if( (strcmp(argv
[1], "-ccr") == 0) || (strcmp(argv
[1], "--create-chains-and-rules") == 0) ) {