OpenVPN gefixt.
[people/pmueller/ipfire-2.x.git] / src / misc-progs / ipsecctrl.c
CommitLineData
05207d69
MT
1/*
2 *
3 * File originally from the Smoothwall project
4 * (c) 2001 Smoothwall Team
5 *
05207d69
MT
6 */
7
8#include "libsmooth.h"
9#include <stdio.h>
10#include <stdlib.h>
11#include <string.h>
12#include <unistd.h>
13#include <sys/types.h>
14#include <sys/stat.h>
15#include <signal.h>
16#include "setuid.h"
17
5fd30232
MT
18/*
19 This module is responsible for start stop of the vpn system.
20
21 1) it allows AH & ESP to get in from interface where a vpn is mounted
22 The NAT traversal is used on the udp 4500 port.
23
24 2) it starts the ipsec daemon
25 The RED interface is a problem because it can be up or down a startup.
26 Then, the state change and it must not affect other VPN mounted on
27 other interface.
28 Unfortunatly, openswan 1 cannot do that correctly. It cannot use an
29 interface without restarting everything.
30
31 IPCop should control vpn this way:
32
33 rc.netaddrsesup.up
34 call ipsecctrl once to start vpns on all interface
35 RED based vpn won't start because "auto=ignore" instead off "auto=start"
36
37 rc.updatered
38 call ipsectrl to turn on or off vpn based on RED
39
40 but now it is only:
41
42 rc.updatered
43 call ipsectrl S at every event on RED.
44 Consequence: BLUE vpn is not started until RED goes up.
45
46
47*/
48
49#define phystable "IPSECPHYSICAL"
50#define virtualtable "IPSECVIRTUAL"
51
05207d69
MT
52void usage() {
53 fprintf (stderr, "Usage:\n");
54 fprintf (stderr, "\tipsecctrl S [connectionkey]\n");
55 fprintf (stderr, "\tipsecctrl D [connectionkey]\n");
56 fprintf (stderr, "\tipsecctrl R\n");
57 fprintf (stderr, "\t\tS : Start/Restart Connection\n");
58 fprintf (stderr, "\t\tD : Stop Connection\n");
59 fprintf (stderr, "\t\tR : Reload Certificates and Secrets\n");
60}
61
5fd30232 62void load_modules() {
05207d69
MT
63 safe_system("/sbin/modprobe ipsec");
64}
65
5fd30232
MT
66/*
67 ACCEPT the ipsec protocol ah, esp & udp (for nat traversal) on the specified interface
68*/
69void open_physical (char *interface, int nat_traversal_port) {
05207d69
MT
70 char str[STRING_SIZE];
71
5fd30232
MT
72 // GRE ???
73 sprintf(str, "/sbin/iptables -A " phystable " -p 47 -i %s -j ACCEPT", interface);
05207d69 74 safe_system(str);
5fd30232
MT
75 // ESP
76 sprintf(str, "/sbin/iptables -A " phystable " -p 50 -i %s -j ACCEPT", interface);
05207d69 77 safe_system(str);
5fd30232
MT
78 // AH
79 sprintf(str, "/sbin/iptables -A " phystable " -p 51 -i %s -j ACCEPT", interface);
05207d69 80 safe_system(str);
5fd30232
MT
81 // IKE
82 sprintf(str, "/sbin/iptables -A " phystable " -p udp -i %s --sport 500 --dport 500 -j ACCEPT", interface);
05207d69 83 safe_system(str);
5fd30232
MT
84
85 if (! nat_traversal_port)
86 return;
87
88 sprintf(str, "/sbin/iptables -A " phystable " -p udp -i %s --dport %i -j ACCEPT", interface, nat_traversal_port);
05207d69
MT
89 safe_system(str);
90}
91
5fd30232
MT
92/*
93 Basic control for what can flow from/to ipsecX interfaces.
94
95 rc.firewall call this chain just before ACCEPTing everything
96 from green (-i DEV_GREEN -j ACCEPT).
97*/
98void open_virtual (void) {
99 // allow anything from any ipsec to go on all interface, including other ipsec
100 safe_system("/sbin/iptables -A " virtualtable " -i ipsec+ -j ACCEPT");
101 //todo: BOT extension?; allowing ipsec0<<==port-list-filter==>>GREEN ?
102}
103
104void ipsec_norules() {
105 /* clear input rules */
106 safe_system("/sbin/iptables -F " phystable);
107 safe_system("/sbin/iptables -F " virtualtable);
108
109 // unmap red alias ????
110}
111
112
113void add_alias_interfaces(char *configtype,
114 char *redtype,
115 char *redif,
116 int offset) //reserve room for ipsec0=red, ipsec1=green, ipsec2=orange,ipsec3=blue
05207d69
MT
117{
118 FILE *file = NULL;
119 char s[STRING_SIZE];
05207d69 120 int alias=0;
05207d69 121
05207d69
MT
122 /* Check for CONFIG_TYPE=2 or 3 i.e. RED ethernet present. If not,
123 * exit gracefully. This is not an error... */
99f3c72f 124 if (!((strcmp(configtype, "1")==0) || (strcmp(configtype, "2")==0) || (strcmp(configtype, "3")==0) || (strcmp(configtype, "4")==0)))
05207d69
MT
125 return;
126
127 /* Now check the RED_TYPE - aliases only work with STATIC. */
128 if (!(strcmp(redtype, "STATIC")==0))
129 return;
130
131 /* Now set up the new aliases from the config file */
132 if (!(file = fopen(CONFIG_ROOT "/ethernet/aliases", "r")))
133 {
134 fprintf(stderr, "Unable to open aliases configuration file\n");
135 return;
136 }
5fd30232 137 while (fgets(s, STRING_SIZE, file) != NULL && (offset+alias) < 16 )
05207d69
MT
138 {
139 if (s[strlen(s) - 1] == '\n')
140 s[strlen(s) - 1] = '\0';
5fd30232
MT
141 int count = 0;
142 char *aliasip=NULL;
143 char *enabled=NULL;
144 char *comment=NULL;
145 char *sptr = strtok(s, ",");
05207d69
MT
146 while (sptr)
147 {
148 if (count == 0)
149 aliasip = sptr;
150 if (count == 1)
151 enabled = sptr;
152 else
153 comment = sptr;
154 count++;
155 sptr = strtok(NULL, ",");
156 }
157
158 if (!(aliasip && enabled))
159 continue;
160
161 if (!VALID_IP(aliasip))
162 {
163 fprintf(stderr, "Bad alias : %s\n", aliasip);
164 return;
165 }
166
167 if (strcmp(enabled, "on") == 0)
168 {
169 memset(s, 0, STRING_SIZE);
5fd30232 170 snprintf(s, STRING_SIZE-1, "/usr/sbin/ipsec tncfg --attach --virtual ipsec%d --physical %s:%d >/dev/null", offset+alias, redif, alias);
05207d69
MT
171 safe_system(s);
172 alias++;
173 }
174 }
175}
176
5fd30232
MT
177/*
178 return values from the vpn config file or false if not 'on'
179*/
180int decode_line (char *s,
181 char **key,
182 char **name,
183 char **type,
184 char **interface
185 ) {
186 int count = 0;
187 *key = NULL;
188 *name = NULL;
189 *type = NULL;
190
191 if (s[strlen(s) - 1] == '\n')
192 s[strlen(s) - 1] = '\0';
193
194 char *result = strsep(&s, ",");
195 while (result) {
196 if (count == 0)
197 *key = result;
198 if ((count == 1) && strcmp(result, "on") != 0)
199 return 0; // a disabled line
200 if (count == 2)
201 *name = result;
202 if (count == 4)
203 *type = result;
204 if (count == 27)
205 *interface = result;
206 count++;
207 result = strsep(&s, ",");
208 }
209
210 // check other syntax
211 if (! *name)
212 return 0;
213
214 if (strspn(*name, LETTERS_NUMBERS) != strlen(*name)) {
215 fprintf(stderr, "Bad connection name: %s\n", *name);
216 return 0;
217 }
218
219 if (! (strcmp(*type, "host") == 0 || strcmp(*type, "net") == 0)) {
220 fprintf(stderr, "Bad connection type: %s\n", *type);
221 return 0;
222 }
223
224 if (! (strcmp(*interface, "RED") == 0 || strcmp(*interface, "GREEN") == 0 ||
225 strcmp(*interface, "ORANGE") == 0 || strcmp(*interface, "BLUE") == 0)) {
226 fprintf(stderr, "Bad interface name: %s\n", *interface);
227 return 0;
228 }
229 //it's a valid & active line
230 return 1;
231}
232
233/*
234 issue ipsec commmands to turn on connection 'name'
235*/
236void turn_connection_on (char *name, char *type) {
237 char command[STRING_SIZE];
238
239 safe_system("/usr/sbin/ipsec auto --rereadsecrets >/dev/null");
240 memset(command, 0, STRING_SIZE);
241 snprintf(command, STRING_SIZE - 1,
242 "/usr/sbin/ipsec auto --replace %s >/dev/null", name);
243 safe_system(command);
244 if (strcmp(type, "net") == 0) {
245 memset(command, 0, STRING_SIZE);
246 snprintf(command, STRING_SIZE - 1,
247 "/usr/sbin/ipsec auto --asynchronous --up %s >/dev/null", name);
248 safe_system(command);
249 }
250}
251/*
252 issue ipsec commmands to turn off connection 'name'
253*/
254void turn_connection_off (char *name) {
255 char command[STRING_SIZE];
256
257 memset(command, 0, STRING_SIZE);
258 snprintf(command, STRING_SIZE - 1,
259 "/usr/sbin/ipsec auto --down %s >/dev/null", name);
260 safe_system(command);
261 memset(command, 0, STRING_SIZE);
262 snprintf(command, STRING_SIZE - 1,
263 "/usr/sbin/ipsec auto --delete %s >/dev/null", name);
264 safe_system(command);
265 safe_system("/usr/sbin/ipsec auto --rereadsecrets >/dev/null");
266}
267
268
05207d69 269int main(int argc, char *argv[]) {
5fd30232 270
05207d69
MT
271 char configtype[STRING_SIZE];
272 char redtype[STRING_SIZE] = "";
05207d69 273 struct keyvalue *kv = NULL;
05207d69 274
05207d69
MT
275 if (argc < 2) {
276 usage();
277 exit(1);
278 }
5fd30232
MT
279 if (!(initsetuid()))
280 exit(1);
dced81b2 281
fe6cda92
CS
282 FILE *file = NULL;
283
dced81b2 284 /* Get vpnwatch pid */
fe6cda92
CS
285
286 if (file = fopen("/var/run/vpn-watch.pid", "r")) {
7dbf47dc 287 safe_system("kill -9 $(cat /var/run/vpn-watch.pid)");
dced81b2
CS
288 safe_system("unlink /var/run/vpn-watch.pid)");
289 }
7dbf47dc 290 close(file);
fe6cda92 291
05207d69
MT
292 /* FIXME: workaround for pclose() issue - still no real idea why
293 * this is happening */
294 signal(SIGCHLD, SIG_DFL);
295
5fd30232
MT
296 /* handle operations that doesn't need start the ipsec system */
297 if (argc == 2) {
298 if (strcmp(argv[1], "D") == 0) {
5fd30232
MT
299 ipsec_norules();
300 /* Only shutdown pluto if it really is running */
301 int fd;
302 /* Get pluto pid */
303 if ((fd = open("/var/run/pluto.pid", O_RDONLY)) != -1) {
341ff36c 304 safe_system("/etc/rc.d/init.d/ipsec stop 2> /dev/null >/dev/null");
5fd30232
MT
305 close(fd);
306 }
307 exit(0);
308 }
05207d69 309
5fd30232
MT
310 if (strcmp(argv[1], "R") == 0) {
311 safe_system("/usr/sbin/ipsec auto --rereadall");
312 exit(0);
313 }
314 }
315
5fd30232
MT
316 /* clear iptables vpn rules */
317 ipsec_norules();
318
319 /* read vpn config */
320 kv=initkeyvalues();
05207d69
MT
321 if (!readkeyvalues(kv, CONFIG_ROOT "/vpn/settings"))
322 {
323 fprintf(stderr, "Cannot read vpn settings\n");
324 exit(1);
325 }
326
5fd30232
MT
327 /* check is the vpn system is enabled */
328 {
329 char s[STRING_SIZE];
330 findkey(kv, "ENABLED", s);
331 freekeyvalues(kv);
332 if (strcmp (s, "on") != 0)
333 exit(0);
334 }
05207d69 335
5fd30232 336 /* read interface settings */
05207d69 337 kv=initkeyvalues();
05207d69
MT
338 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
339 {
340 fprintf(stderr, "Cannot read ethernet settings\n");
341 exit(1);
342 }
05207d69
MT
343 if (!findkey(kv, "CONFIG_TYPE", configtype))
344 {
345 fprintf(stderr, "Cannot read CONFIG_TYPE\n");
346 exit(1);
347 }
05207d69 348 findkey(kv, "RED_TYPE", redtype);
05207d69 349
05207d69 350
5fd30232
MT
351 /* Loop through the config file to find physical interface that will accept IPSEC */
352 int enable_red=0; // states 0: not used
353 int enable_green=0; // 1: error condition
354 int enable_orange=0; // 2: good
355 int enable_blue=0;
356 char if_red[STRING_SIZE] = "";
357 char if_green[STRING_SIZE] = "";
358 char if_orange[STRING_SIZE] = "";
359 char if_blue[STRING_SIZE] = "";
360 char s[STRING_SIZE];
05207d69 361
5fd30232
MT
362 if (!(file = fopen(CONFIG_ROOT "/vpn/config", "r"))) {
363 fprintf(stderr, "Couldn't open vpn settings file");
364 exit(1);
05207d69 365 }
5fd30232
MT
366 while (fgets(s, STRING_SIZE, file) != NULL) {
367 char *key;
368 char *name;
369 char *type;
370 char *interface;
371 if (!decode_line(s,&key,&name,&type,&interface))
372 continue;
373 /* search interface */
374 if (!enable_red && strcmp (interface, "RED") == 0) {
375 // when RED is up, find interface name in special file
376 FILE *ifacefile = NULL;
377 if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r"))) {
378 if (fgets(if_red, STRING_SIZE, ifacefile)) {
379 if (if_red[strlen(if_red) - 1] == '\n')
380 if_red[strlen(if_red) - 1] = '\0';
381 }
382 fclose (ifacefile);
05207d69 383
5fd30232
MT
384 if (VALID_DEVICE(if_red))
385 enable_red+=2; // present and running
05207d69
MT
386 }
387 }
05207d69 388
5fd30232
MT
389 if (!enable_green && strcmp (interface, "GREEN") == 0) {
390 enable_green = 1;
391 findkey(kv, "GREEN_DEV", if_green);
392 if (VALID_DEVICE(if_green))
393 enable_green++;
394 else
395 fprintf(stderr, "IPSec enabled on green but green interface is invalid or not found\n");
05207d69 396 }
5fd30232
MT
397
398 if (!enable_orange && strcmp (interface, "ORANGE") == 0) {
399 enable_orange = 1;
400 findkey(kv, "ORANGE_DEV", if_orange);
401 if (VALID_DEVICE(if_orange))
402 enable_orange++;
403 else
404 fprintf(stderr, "IPSec enabled on orange but orange interface is invalid or not found\n");
05207d69 405 }
05207d69 406
5fd30232
MT
407 if (!enable_blue && strcmp (interface, "BLUE") == 0) {
408 enable_blue++;
409 findkey(kv, "BLUE_DEV", if_blue);
410 if (VALID_DEVICE(if_blue))
411 enable_blue++;
412 else
413 fprintf(stderr, "IPSec enabled on blue but blue interface is invalid or not found\n");
414
05207d69 415 }
5fd30232
MT
416 }
417 fclose(file);
418 freekeyvalues(kv);
419
420 // do nothing if something is in error condition
421 if ((enable_red==1) || (enable_green==1) || (enable_orange==1) || (enable_blue==1) )
422 exit(1);
423
424 // exit if nothing to do
425 if ( (enable_red+enable_green+enable_orange+enable_blue) == 0 )
426 exit(0);
427
428 // open needed ports
429 // todo: read a nat_t indicator to allow or not openning UDP/4500
430 if (enable_red==2)
431 open_physical(if_red, 4500);
432
433 if (enable_green==2)
434 open_physical(if_green, 4500);
435
436 if (enable_orange==2)
437 open_physical(if_orange, 4500);
438
439 if (enable_blue==2)
440 open_physical(if_blue, 4500);
441
442 // then open the ipsecX
443 open_virtual();
444
445 // start the system
446 if ((argc == 2) && strcmp(argv[1], "S") == 0) {
447 load_modules();
448 safe_system("/usr/sbin/ipsec tncfg --clear >/dev/null");
341ff36c 449 safe_system("/etc/rc.d/init.d/ipsec restart >/dev/null");
5fd30232 450 add_alias_interfaces(configtype, redtype, if_red, (enable_red+enable_green+enable_orange+enable_blue) >>1 );
5fd30232
MT
451 exit(0);
452 }
453
454 // it is a selective start or stop
455 // second param is only a number 'key'
456 if ((argc == 2) || strspn(argv[2], NUMBERS) != strlen(argv[2])) {
457 ipsec_norules();
05207d69
MT
458 fprintf(stderr, "Bad arg\n");
459 usage();
460 exit(1);
461 }
462
5fd30232
MT
463 // search the vpn pointed by 'key'
464 if (!(file = fopen(CONFIG_ROOT "/vpn/config", "r"))) {
465 ipsec_norules();
466 fprintf(stderr, "Couldn't open vpn settings file");
467 exit(1);
468 }
469 while (fgets(s, STRING_SIZE, file) != NULL) {
470 char *key;
471 char *name;
472 char *type;
473 char *interface;
474 if (!decode_line(s,&key,&name,&type,&interface))
475 continue;
476
477 // start/stop a vpn if belonging to specified interface
478 if (strcmp(argv[1], interface) == 0 ) {
479 if (strcmp(argv[2], "0")==0)
480 turn_connection_off (name);
481 else
482 turn_connection_on (name, type);
483 continue;
484 }
485 // is it the 'key' requested ?
486 if (strcmp(argv[2], key) != 0)
487 continue;
488 // Start or Delete this Connection
489 if (strcmp(argv[1], "S") == 0)
490 turn_connection_on (name, type);
491 else
492 if (strcmp(argv[1], "D") == 0)
493 turn_connection_off (name);
494 else {
495 ipsec_norules();
496 fprintf(stderr, "Bad command\n");
497 exit(1);
498 }
499 }
500 fclose(file);
99f3c72f 501 safe_system("/usr/local/bin/vpn-watch &");
05207d69
MT
502 return 0;
503}