299264728aec9bc2913edb38c4eba4b3a8f1a26c
[people/pmueller/ipfire-2.x.git] / src / misc-progs / ipsecctrl.c
1 /*
2 *
3 * File originally from the Smoothwall project
4 * (c) 2001 Smoothwall Team
5 *
6 */
7
8 #include "libsmooth.h"
9 #include <stdio.h>
10 #include <stdlib.h>
11 #include <string.h>
12 #include <unistd.h>
13 #include <sys/types.h>
14 #include <sys/stat.h>
15 #include <signal.h>
16 #include "setuid.h"
17
18 /*
19 This module is responsible for start stop of the vpn system.
20
21 1) it allows AH & ESP to get in from interface where a vpn is mounted
22 The NAT traversal is used on the udp 4500 port.
23
24 2) it starts the ipsec daemon
25 The RED interface is a problem because it can be up or down a startup.
26 Then, the state change and it must not affect other VPN mounted on
27 other interface.
28 Unfortunatly, openswan 1 cannot do that correctly. It cannot use an
29 interface without restarting everything.
30
31 IPCop should control vpn this way:
32
33 rc.netaddrsesup.up
34 call ipsecctrl once to start vpns on all interface
35 RED based vpn won't start because "auto=ignore" instead off "auto=start"
36
37 rc.updatered
38 call ipsectrl to turn on or off vpn based on RED
39
40 but now it is only:
41
42 rc.updatered
43 call ipsectrl S at every event on RED.
44 Consequence: BLUE vpn is not started until RED goes up.
45
46
47 */
48
49 #define phystable "IPSECPHYSICAL"
50 #define virtualtable "IPSECVIRTUAL"
51
52 void usage() {
53 fprintf (stderr, "Usage:\n");
54 fprintf (stderr, "\tipsecctrl S [connectionkey]\n");
55 fprintf (stderr, "\tipsecctrl D [connectionkey]\n");
56 fprintf (stderr, "\tipsecctrl R\n");
57 fprintf (stderr, "\t\tS : Start/Restart Connection\n");
58 fprintf (stderr, "\t\tD : Stop Connection\n");
59 fprintf (stderr, "\t\tR : Reload Certificates and Secrets\n");
60 }
61
62 void load_modules() {
63 safe_system("/sbin/modprobe ipsec");
64 }
65
66 /*
67 ACCEPT the ipsec protocol ah, esp & udp (for nat traversal) on the specified interface
68 */
69 void open_physical (char *interface, int nat_traversal_port) {
70 char str[STRING_SIZE];
71
72 // GRE ???
73 sprintf(str, "/sbin/iptables -A " phystable " -p 47 -i %s -j ACCEPT", interface);
74 safe_system(str);
75 // ESP
76 sprintf(str, "/sbin/iptables -A " phystable " -p 50 -i %s -j ACCEPT", interface);
77 safe_system(str);
78 // AH
79 sprintf(str, "/sbin/iptables -A " phystable " -p 51 -i %s -j ACCEPT", interface);
80 safe_system(str);
81 // IKE
82 sprintf(str, "/sbin/iptables -A " phystable " -p udp -i %s --sport 500 --dport 500 -j ACCEPT", interface);
83 safe_system(str);
84
85 if (! nat_traversal_port)
86 return;
87
88 sprintf(str, "/sbin/iptables -A " phystable " -p udp -i %s --dport %i -j ACCEPT", interface, nat_traversal_port);
89 safe_system(str);
90 }
91
92 /*
93 Basic control for what can flow from/to ipsecX interfaces.
94
95 rc.firewall call this chain just before ACCEPTing everything
96 from green (-i DEV_GREEN -j ACCEPT).
97 */
98 void open_virtual (void) {
99 // allow anything from any ipsec to go on all interface, including other ipsec
100 safe_system("/sbin/iptables -A " virtualtable " -i ipsec+ -j ACCEPT");
101 //todo: BOT extension?; allowing ipsec0<<==port-list-filter==>>GREEN ?
102 }
103
104 void ipsec_norules() {
105 /* clear input rules */
106 safe_system("/sbin/iptables -F " phystable);
107 safe_system("/sbin/iptables -F " virtualtable);
108
109 // unmap red alias ????
110 }
111
112
113 void add_alias_interfaces(char *configtype,
114 char *redtype,
115 char *redif,
116 int offset) //reserve room for ipsec0=red, ipsec1=green, ipsec2=orange,ipsec3=blue
117 {
118 FILE *file = NULL;
119 char s[STRING_SIZE];
120 int alias=0;
121
122 /* Check for CONFIG_TYPE=2 or 3 i.e. RED ethernet present. If not,
123 * exit gracefully. This is not an error... */
124 if (!((strcmp(configtype, "2")==0) || (strcmp(configtype, "3")==0) || (strcmp(configtype, "6")==0) || (strcmp(configtype, "7")==0)))
125 return;
126
127 /* Now check the RED_TYPE - aliases only work with STATIC. */
128 if (!(strcmp(redtype, "STATIC")==0))
129 return;
130
131 /* Now set up the new aliases from the config file */
132 if (!(file = fopen(CONFIG_ROOT "/ethernet/aliases", "r")))
133 {
134 fprintf(stderr, "Unable to open aliases configuration file\n");
135 return;
136 }
137 while (fgets(s, STRING_SIZE, file) != NULL && (offset+alias) < 16 )
138 {
139 if (s[strlen(s) - 1] == '\n')
140 s[strlen(s) - 1] = '\0';
141 int count = 0;
142 char *aliasip=NULL;
143 char *enabled=NULL;
144 char *comment=NULL;
145 char *sptr = strtok(s, ",");
146 while (sptr)
147 {
148 if (count == 0)
149 aliasip = sptr;
150 if (count == 1)
151 enabled = sptr;
152 else
153 comment = sptr;
154 count++;
155 sptr = strtok(NULL, ",");
156 }
157
158 if (!(aliasip && enabled))
159 continue;
160
161 if (!VALID_IP(aliasip))
162 {
163 fprintf(stderr, "Bad alias : %s\n", aliasip);
164 return;
165 }
166
167 if (strcmp(enabled, "on") == 0)
168 {
169 memset(s, 0, STRING_SIZE);
170 snprintf(s, STRING_SIZE-1, "/usr/sbin/ipsec tncfg --attach --virtual ipsec%d --physical %s:%d >/dev/null", offset+alias, redif, alias);
171 safe_system(s);
172 alias++;
173 }
174 }
175 }
176
177 /*
178 return values from the vpn config file or false if not 'on'
179 */
180 int decode_line (char *s,
181 char **key,
182 char **name,
183 char **type,
184 char **interface
185 ) {
186 int count = 0;
187 *key = NULL;
188 *name = NULL;
189 *type = NULL;
190
191 if (s[strlen(s) - 1] == '\n')
192 s[strlen(s) - 1] = '\0';
193
194 char *result = strsep(&s, ",");
195 while (result) {
196 if (count == 0)
197 *key = result;
198 if ((count == 1) && strcmp(result, "on") != 0)
199 return 0; // a disabled line
200 if (count == 2)
201 *name = result;
202 if (count == 4)
203 *type = result;
204 if (count == 27)
205 *interface = result;
206 count++;
207 result = strsep(&s, ",");
208 }
209
210 // check other syntax
211 if (! *name)
212 return 0;
213
214 if (strspn(*name, LETTERS_NUMBERS) != strlen(*name)) {
215 fprintf(stderr, "Bad connection name: %s\n", *name);
216 return 0;
217 }
218
219 if (! (strcmp(*type, "host") == 0 || strcmp(*type, "net") == 0)) {
220 fprintf(stderr, "Bad connection type: %s\n", *type);
221 return 0;
222 }
223
224 if (! (strcmp(*interface, "RED") == 0 || strcmp(*interface, "GREEN") == 0 ||
225 strcmp(*interface, "ORANGE") == 0 || strcmp(*interface, "BLUE") == 0)) {
226 fprintf(stderr, "Bad interface name: %s\n", *interface);
227 return 0;
228 }
229 //it's a valid & active line
230 return 1;
231 }
232
233 /*
234 issue ipsec commmands to turn on connection 'name'
235 */
236 void turn_connection_on (char *name, char *type) {
237 char command[STRING_SIZE];
238
239 safe_system("/usr/sbin/ipsec auto --rereadsecrets >/dev/null");
240 memset(command, 0, STRING_SIZE);
241 snprintf(command, STRING_SIZE - 1,
242 "/usr/sbin/ipsec auto --replace %s >/dev/null", name);
243 safe_system(command);
244 if (strcmp(type, "net") == 0) {
245 memset(command, 0, STRING_SIZE);
246 snprintf(command, STRING_SIZE - 1,
247 "/usr/sbin/ipsec auto --asynchronous --up %s >/dev/null", name);
248 safe_system(command);
249 }
250 }
251 /*
252 issue ipsec commmands to turn off connection 'name'
253 */
254 void turn_connection_off (char *name) {
255 char command[STRING_SIZE];
256
257 memset(command, 0, STRING_SIZE);
258 snprintf(command, STRING_SIZE - 1,
259 "/usr/sbin/ipsec auto --down %s >/dev/null", name);
260 safe_system(command);
261 memset(command, 0, STRING_SIZE);
262 snprintf(command, STRING_SIZE - 1,
263 "/usr/sbin/ipsec auto --delete %s >/dev/null", name);
264 safe_system(command);
265 safe_system("/usr/sbin/ipsec auto --rereadsecrets >/dev/null");
266 }
267
268
269 int main(int argc, char *argv[]) {
270
271 char configtype[STRING_SIZE];
272 char redtype[STRING_SIZE] = "";
273 struct keyvalue *kv = NULL;
274
275 if (argc < 2) {
276 usage();
277 exit(1);
278 }
279 if (!(initsetuid()))
280 exit(1);
281
282 /* FIXME: workaround for pclose() issue - still no real idea why
283 * this is happening */
284 signal(SIGCHLD, SIG_DFL);
285
286 /* handle operations that doesn't need start the ipsec system */
287 if (argc == 2) {
288 if (strcmp(argv[1], "D") == 0) {
289 safe_system("/usr/local/bin/vpn-watch --stop");
290 ipsec_norules();
291 /* Only shutdown pluto if it really is running */
292 int fd;
293 /* Get pluto pid */
294 if ((fd = open("/var/run/pluto.pid", O_RDONLY)) != -1) {
295 safe_system("/etc/rc.d/init.d/ipsec stop 2> /dev/null >/dev/null");
296 close(fd);
297 }
298 exit(0);
299 }
300
301 if (strcmp(argv[1], "R") == 0) {
302 safe_system("/usr/sbin/ipsec auto --rereadall");
303 exit(0);
304 }
305 }
306
307 /* stop the watch script as soon as possible */
308 safe_system("/usr/local/bin/vpn-watch --stop");
309
310 /* clear iptables vpn rules */
311 ipsec_norules();
312
313 /* read vpn config */
314 kv=initkeyvalues();
315 if (!readkeyvalues(kv, CONFIG_ROOT "/vpn/settings"))
316 {
317 fprintf(stderr, "Cannot read vpn settings\n");
318 exit(1);
319 }
320
321 /* check is the vpn system is enabled */
322 {
323 char s[STRING_SIZE];
324 findkey(kv, "ENABLED", s);
325 freekeyvalues(kv);
326 if (strcmp (s, "on") != 0)
327 exit(0);
328 }
329
330 /* read interface settings */
331 kv=initkeyvalues();
332 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
333 {
334 fprintf(stderr, "Cannot read ethernet settings\n");
335 exit(1);
336 }
337 if (!findkey(kv, "CONFIG_TYPE", configtype))
338 {
339 fprintf(stderr, "Cannot read CONFIG_TYPE\n");
340 exit(1);
341 }
342 findkey(kv, "RED_TYPE", redtype);
343
344
345 /* Loop through the config file to find physical interface that will accept IPSEC */
346 int enable_red=0; // states 0: not used
347 int enable_green=0; // 1: error condition
348 int enable_orange=0; // 2: good
349 int enable_blue=0;
350 char if_red[STRING_SIZE] = "";
351 char if_green[STRING_SIZE] = "";
352 char if_orange[STRING_SIZE] = "";
353 char if_blue[STRING_SIZE] = "";
354 char s[STRING_SIZE];
355 FILE *file = NULL;
356
357 if (!(file = fopen(CONFIG_ROOT "/vpn/config", "r"))) {
358 fprintf(stderr, "Couldn't open vpn settings file");
359 exit(1);
360 }
361 while (fgets(s, STRING_SIZE, file) != NULL) {
362 char *key;
363 char *name;
364 char *type;
365 char *interface;
366 if (!decode_line(s,&key,&name,&type,&interface))
367 continue;
368 /* search interface */
369 if (!enable_red && strcmp (interface, "RED") == 0) {
370 // when RED is up, find interface name in special file
371 FILE *ifacefile = NULL;
372 if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r"))) {
373 if (fgets(if_red, STRING_SIZE, ifacefile)) {
374 if (if_red[strlen(if_red) - 1] == '\n')
375 if_red[strlen(if_red) - 1] = '\0';
376 }
377 fclose (ifacefile);
378
379 if (VALID_DEVICE(if_red))
380 enable_red+=2; // present and running
381 }
382 }
383
384 if (!enable_green && strcmp (interface, "GREEN") == 0) {
385 enable_green = 1;
386 findkey(kv, "GREEN_DEV", if_green);
387 if (VALID_DEVICE(if_green))
388 enable_green++;
389 else
390 fprintf(stderr, "IPSec enabled on green but green interface is invalid or not found\n");
391 }
392
393 if (!enable_orange && strcmp (interface, "ORANGE") == 0) {
394 enable_orange = 1;
395 findkey(kv, "ORANGE_DEV", if_orange);
396 if (VALID_DEVICE(if_orange))
397 enable_orange++;
398 else
399 fprintf(stderr, "IPSec enabled on orange but orange interface is invalid or not found\n");
400 }
401
402 if (!enable_blue && strcmp (interface, "BLUE") == 0) {
403 enable_blue++;
404 findkey(kv, "BLUE_DEV", if_blue);
405 if (VALID_DEVICE(if_blue))
406 enable_blue++;
407 else
408 fprintf(stderr, "IPSec enabled on blue but blue interface is invalid or not found\n");
409
410 }
411 }
412 fclose(file);
413 freekeyvalues(kv);
414
415 // do nothing if something is in error condition
416 if ((enable_red==1) || (enable_green==1) || (enable_orange==1) || (enable_blue==1) )
417 exit(1);
418
419 // exit if nothing to do
420 if ( (enable_red+enable_green+enable_orange+enable_blue) == 0 )
421 exit(0);
422
423 // open needed ports
424 // todo: read a nat_t indicator to allow or not openning UDP/4500
425 if (enable_red==2)
426 open_physical(if_red, 4500);
427
428 if (enable_green==2)
429 open_physical(if_green, 4500);
430
431 if (enable_orange==2)
432 open_physical(if_orange, 4500);
433
434 if (enable_blue==2)
435 open_physical(if_blue, 4500);
436
437 // then open the ipsecX
438 open_virtual();
439
440 // start the system
441 if ((argc == 2) && strcmp(argv[1], "S") == 0) {
442 load_modules();
443 safe_system("/usr/sbin/ipsec tncfg --clear >/dev/null");
444 safe_system("/etc/rc.d/init.d/ipsec restart >/dev/null");
445 add_alias_interfaces(configtype, redtype, if_red, (enable_red+enable_green+enable_orange+enable_blue) >>1 );
446 safe_system("/usr/local/bin/vpn-watch --start");
447 exit(0);
448 }
449
450 // it is a selective start or stop
451 // second param is only a number 'key'
452 if ((argc == 2) || strspn(argv[2], NUMBERS) != strlen(argv[2])) {
453 ipsec_norules();
454 fprintf(stderr, "Bad arg\n");
455 usage();
456 exit(1);
457 }
458
459 // search the vpn pointed by 'key'
460 if (!(file = fopen(CONFIG_ROOT "/vpn/config", "r"))) {
461 ipsec_norules();
462 fprintf(stderr, "Couldn't open vpn settings file");
463 exit(1);
464 }
465 while (fgets(s, STRING_SIZE, file) != NULL) {
466 char *key;
467 char *name;
468 char *type;
469 char *interface;
470 if (!decode_line(s,&key,&name,&type,&interface))
471 continue;
472
473 // start/stop a vpn if belonging to specified interface
474 if (strcmp(argv[1], interface) == 0 ) {
475 if (strcmp(argv[2], "0")==0)
476 turn_connection_off (name);
477 else
478 turn_connection_on (name, type);
479 continue;
480 }
481 // is it the 'key' requested ?
482 if (strcmp(argv[2], key) != 0)
483 continue;
484 // Start or Delete this Connection
485 if (strcmp(argv[1], "S") == 0)
486 turn_connection_on (name, type);
487 else
488 if (strcmp(argv[1], "D") == 0)
489 turn_connection_off (name);
490 else {
491 ipsec_norules();
492 fprintf(stderr, "Bad command\n");
493 exit(1);
494 }
495 }
496 fclose(file);
497 safe_system("/usr/local/bin/vpn-watch --start");
498 return 0;
499 }