257778892a1868bdb302614de2a1fcc970b3d619
[people/teissler/ipfire-2.x.git] / src / misc-progs / openvpnctrl.c
1 #include <signal.h>
2 #include <stdio.h>
3 #include <string.h>
4 #include <unistd.h>
5 #include <stdlib.h>
6 #include <sys/types.h>
7 #include <arpa/inet.h>
8 #include <netinet/in.h>
9 #include <fcntl.h>
10 #include "setuid.h"
11 #include "netutil.h"
12 #include "libsmooth.h"
13
14 #define noovpndebug
15
16 // global vars
17 struct keyvalue *kv = NULL;
18 FILE *ifacefile = NULL;
19
20 char redif[STRING_SIZE];
21 char blueif[STRING_SIZE];
22 char orangeif[STRING_SIZE];
23 char enablered[STRING_SIZE] = "off";
24 char enableblue[STRING_SIZE] = "off";
25 char enableorange[STRING_SIZE] = "off";
26
27 // consts
28 char OVPNRED[STRING_SIZE] = "OVPN";
29 char OVPNBLUE[STRING_SIZE] = "OVPN_BLUE_";
30 char OVPNORANGE[STRING_SIZE] = "OVPN_ORANGE_";
31 char OVPNBLOCK[STRING_SIZE] = "OVPNBLOCK";
32 char OVPNNAT[STRING_SIZE] = "OVPNNAT";
33 char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.3";
34
35 struct connection_struct {
36 char name[STRING_SIZE];
37 char type[STRING_SIZE];
38 char proto[STRING_SIZE];
39 char status[STRING_SIZE];
40 char local_subnet[STRING_SIZE];
41 char transfer_subnet[STRING_SIZE];
42 char role[STRING_SIZE];
43 int port;
44 struct connection_struct *next;
45 };
46
47 typedef struct connection_struct connection;
48
49 void exithandler(void)
50 {
51 if(kv)
52 freekeyvalues(kv);
53 if (ifacefile)
54 fclose(ifacefile);
55 }
56
57 void usage(void)
58 {
59 #ifdef ovpndebug
60 printf("Wrapper for OpenVPN %s-debug\n", WRAPPERVERSION);
61 #else
62 printf("Wrapper for OpenVPN %s\n", WRAPPERVERSION);
63 #endif
64 printf("openvpnctrl <option>\n");
65 printf(" Valid options are:\n");
66 printf(" -s --start\n");
67 printf(" starts OpenVPN (implicitly creates chains and firewall rules)\n");
68 printf(" -k --kill\n");
69 printf(" kills/stops OpenVPN\n");
70 printf(" -r --restart\n");
71 printf(" restarts OpenVPN (implicitly creates chains and firewall rules)\n");
72 printf(" -sn2n --start-net-2-net\n");
73 printf(" starts all net2net connections\n");
74 printf(" you may pass a connection name to the switch to only start a specific one\n");
75 printf(" -kn2n --kill-net-2-net\n");
76 printf(" kills all net2net connections\n");
77 printf(" you may pass a connection name to the switch to only start a specific one\n");
78 printf(" -d --display\n");
79 printf(" displays OpenVPN status to syslog\n");
80 printf(" -fwr --firewall-rules\n");
81 printf(" removes current OpenVPN chains and rules and resets them according to the config\n");
82 printf(" -sdo --start-daemon-only\n");
83 printf(" starts OpenVPN daemon only\n");
84 printf(" -ccr --create-chains-and-rules\n");
85 printf(" creates chains and rules for OpenVPN\n");
86 printf(" -dcr --delete-chains-and-rules\n");
87 printf(" removes all chains for OpenVPN\n");
88 exit(1);
89 }
90
91 connection *getConnections() {
92 FILE *fp = NULL;
93
94 if (!(fp = fopen(CONFIG_ROOT "/ovpn/ovpnconfig", "r"))) {
95 fprintf(stderr, "Could not open openvpn n2n configuration file.\n");
96 exit(1);
97 }
98
99 char line[STRING_SIZE] = "";
100 char result[STRING_SIZE] = "";
101 char *resultptr;
102 int count;
103 connection *conn_first = NULL;
104 connection *conn_last = NULL;
105 connection *conn_curr;
106
107 while ((fgets(line, STRING_SIZE, fp) != NULL)) {
108 if (line[strlen(line) - 1] == '\n')
109 line[strlen(line) - 1] = '\0';
110
111 conn_curr = (connection *)malloc(sizeof(connection));
112 memset(conn_curr, 0, sizeof(connection));
113
114 if (conn_first == NULL) {
115 conn_first = conn_curr;
116 } else {
117 conn_last->next = conn_curr;
118 }
119 conn_last = conn_curr;
120
121 count = 0;
122 char *lineptr = &line;
123 while (1) {
124 if (*lineptr == NULL)
125 break;
126
127 resultptr = result;
128 while (*lineptr != NULL) {
129 if (*lineptr == ',') {
130 lineptr++;
131 break;
132 }
133 *resultptr++ = *lineptr++;
134 }
135 *resultptr = '\0';
136
137 if (count == 1) {
138 strcpy(conn_curr->status, result);
139 } else if (count == 2) {
140 strcpy(conn_curr->name, result);
141 } else if (count == 4) {
142 strcpy(conn_curr->type, result);
143 } else if (count == 7) {
144 strcpy(conn_curr->role, result);
145 } else if (count == 9) {
146 strcpy(conn_curr->local_subnet, result);
147 } else if (count == 28) {
148 strcpy(conn_curr->transfer_subnet, result);
149 } else if (count == 29) {
150 strcpy(conn_curr->proto, result);
151 } else if (count == 30) {
152 conn_curr->port = atoi(result);
153 }
154
155 count++;
156 }
157 }
158
159 fclose(fp);
160
161 return conn_first;
162 }
163
164 int readPidFile(const char *pidfile) {
165 FILE *fp = fopen(pidfile, "r");
166 if (fp == NULL) {
167 exit(1);
168 }
169
170 int pid = 0;
171 fscanf(fp, "%d", &pid);
172 fclose(fp);
173
174 return pid;
175 }
176
177 void ovpnInit(void) {
178 // Read OpenVPN configuration
179 kv = initkeyvalues();
180 if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings")) {
181 fprintf(stderr, "Cannot read ovpn settings\n");
182 exit(1);
183 }
184
185 if (!findkey(kv, "ENABLED", enablered)) {
186 exit(1);
187 }
188
189 if (!findkey(kv, "ENABLED_BLUE", enableblue)){
190 exit(1);
191 }
192
193 if (!findkey(kv, "ENABLED_ORANGE", enableorange)){
194 exit(1);
195 }
196 freekeyvalues(kv);
197
198 // read interface settings
199
200 // details for the red int
201 memset(redif, 0, STRING_SIZE);
202 if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r")))
203 {
204 if (fgets(redif, STRING_SIZE, ifacefile))
205 {
206 if (redif[strlen(redif) - 1] == '\n')
207 redif[strlen(redif) - 1] = '\0';
208 }
209 fclose (ifacefile);
210 ifacefile = NULL;
211
212 if (!VALID_DEVICE(redif))
213 {
214 memset(redif, 0, STRING_SIZE);
215 }
216 }
217
218 kv=initkeyvalues();
219 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
220 fprintf(stderr, "Cannot read ethernet settings\n");
221 exit(1);
222 }
223
224 if (strcmp(enableblue, "on") == 0) {
225 if (!findkey(kv, "BLUE_DEV", blueif)) {
226 exit(1);
227 }
228 }
229
230 if (strcmp(enableorange, "on") == 0) {
231 if (!findkey(kv, "ORANGE_DEV", orangeif)) {
232 exit(1);
233 }
234 }
235 freekeyvalues(kv);
236 }
237
238 void executeCommand(char *command) {
239 #ifdef ovpndebug
240 printf(strncat(command, "\n", 2));
241 #endif
242 safe_system(strncat(command, " >/dev/null 2>&1", 17));
243 }
244
245 void setChainRules(char *chain, char *interface, char *protocol, char *port)
246 {
247 char str[STRING_SIZE];
248
249 sprintf(str, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %s -j ACCEPT", chain, interface, protocol, port);
250 executeCommand(str);
251 }
252
253 void flushChain(char *chain) {
254 char str[STRING_SIZE];
255
256 sprintf(str, "/sbin/iptables -F %s", chain);
257 executeCommand(str);
258 }
259
260 void flushChainNAT(char *chain) {
261 char str[STRING_SIZE];
262
263 sprintf(str, "/sbin/iptables -t nat -F %s", chain);
264 executeCommand(str);
265 }
266
267 void flushChainINPUT(char *chain) {
268 char str[STRING_SIZE];
269
270 snprintf(str, STRING_SIZE, "%sINPUT", chain);
271 flushChain(str);
272 }
273
274 void deleteChainReference(char *chain) {
275 char str[STRING_SIZE];
276
277 sprintf(str, "/sbin/iptables -D INPUT -j %sINPUT", chain);
278 executeCommand(str);
279 }
280
281 void deleteChain(char *chain) {
282 char str[STRING_SIZE];
283
284 sprintf(str, "/sbin/iptables -X %sINPUT", chain);
285 executeCommand(str);
286 }
287
288 void deleteAllChains(void) {
289 // not an elegant solution, but to avoid timing problems with undeleted chain references
290 deleteChainReference(OVPNRED);
291 deleteChainReference(OVPNBLUE);
292 deleteChainReference(OVPNORANGE);
293 flushChainINPUT(OVPNRED);
294 flushChainINPUT(OVPNBLUE);
295 flushChainINPUT(OVPNORANGE);
296 deleteChain(OVPNRED);
297 deleteChain(OVPNBLUE);
298 deleteChain(OVPNORANGE);
299
300 // Only flush chains that are created by the firewall
301 flushChain(OVPNBLOCK);
302 flushChainNAT(OVPNNAT);
303 }
304
305 void createChainReference(char *chain) {
306 char str[STRING_SIZE];
307 sprintf(str, "/sbin/iptables -I INPUT %s -j %sINPUT", "14", chain);
308 executeCommand(str);
309 }
310
311 void createChain(char *chain) {
312 char str[STRING_SIZE];
313 sprintf(str, "/sbin/iptables -N %sINPUT", chain);
314 executeCommand(str);
315 }
316
317 void createAllChains(void) {
318 // create chain and chain references
319 if (!strcmp(enableorange, "on")) {
320 if (strlen(orangeif) > 0) {
321 createChain(OVPNORANGE);
322 createChainReference(OVPNORANGE);
323 } else {
324 fprintf(stderr, "OpenVPN enabled on orange but no orange interface found\n");
325 //exit(1);
326 }
327 }
328
329 if (!strcmp(enableblue, "on")) {
330 if (strlen(blueif) > 0) {
331 createChain(OVPNBLUE);
332 createChainReference(OVPNBLUE);
333 } else {
334 fprintf(stderr, "OpenVPN enabled on blue but no blue interface found\n");
335 //exit(1);
336 }
337 }
338
339 if (!strcmp(enablered, "on")) {
340 if (strlen(redif) > 0) {
341 createChain(OVPNRED);
342 createChainReference(OVPNRED);
343 } else {
344 fprintf(stderr, "OpenVPN enabled on red but no red interface found\n");
345 //exit(1);
346 }
347 }
348 }
349
350 char* calcTransferNetAddress(const connection* conn) {
351 char *subnetmask = strdup(conn->transfer_subnet);
352 char *address = strsep(&subnetmask, "/");
353
354 if ((address == NULL) || (subnetmask == NULL)) {
355 goto ERROR;
356 }
357
358 in_addr_t _address = inet_addr(address);
359 in_addr_t _subnetmask = inet_addr(subnetmask);
360 _address &= _subnetmask;
361
362 if (strcmp(conn->role, "server") == 0) {
363 _address += 1 << 24;
364 } else if (strcmp(conn->role, "client") == 0) {
365 _address += 2 << 24;
366 } else {
367 goto ERROR;
368 }
369
370 struct in_addr address_info;
371 address_info.s_addr = _address;
372
373 return inet_ntoa(address_info);
374
375 ERROR:
376 fprintf(stderr, "Could not determine transfer net address: %s\n", conn->name);
377
378 free(address);
379 return NULL;
380 }
381
382 char* getLocalSubnetAddress(const connection* conn) {
383 kv = initkeyvalues();
384 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
385 fprintf(stderr, "Cannot read ethernet settings\n");
386 exit(1);
387 }
388
389 const char *zones[] = {"GREEN", "BLUE", "ORANGE", NULL};
390 char *zone = NULL;
391
392 // Get net address of the local openvpn subnet.
393 char *subnetmask = strdup(conn->local_subnet);
394 char *address = strsep(&subnetmask, "/");
395
396 if ((address == NULL) || (subnetmask == NULL)) {
397 goto ERROR;
398 }
399
400 in_addr_t _address = inet_addr(address);
401 in_addr_t _subnetmask = inet_addr(subnetmask);
402
403 in_addr_t _netaddr = (_address & _subnetmask);
404 in_addr_t _broadcast = (_address | ~_subnetmask);
405
406 char zone_address_key[STRING_SIZE];
407 char zone_address[STRING_SIZE];
408 in_addr_t zone_addr;
409
410 int i = 0;
411 while (zones[i]) {
412 zone = zones[i++];
413 snprintf(zone_address_key, STRING_SIZE, "%s_ADDRESS", zone);
414
415 if (!findkey(kv, zone_address_key, zone_address))
416 continue;
417
418 zone_addr = inet_addr(zone_address);
419 if ((zone_addr > _netaddr) && (zone_addr < _broadcast)) {
420 freekeyvalues(kv);
421
422 return strdup(zone_address);
423 }
424 }
425
426 ERROR:
427 fprintf(stderr, "Could not determine local subnet address: %s\n", conn->name);
428
429 freekeyvalues(kv);
430 return NULL;
431 }
432
433 void setFirewallRules(void) {
434 char protocol[STRING_SIZE] = "";
435 char dport[STRING_SIZE] = "";
436 char dovpnip[STRING_SIZE] = "";
437
438 kv = initkeyvalues();
439 if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings"))
440 {
441 fprintf(stderr, "Cannot read ovpn settings\n");
442 exit(1);
443 }
444
445 /* we got one device, so lets proceed further */
446 if (!findkey(kv, "DDEST_PORT", dport)){
447 fprintf(stderr, "Cannot read DDEST_PORT\n");
448 exit(1);
449 }
450
451 if (!findkey(kv, "DPROTOCOL", protocol)){
452 fprintf(stderr, "Cannot read DPROTOCOL\n");
453 exit(1);
454 }
455
456 if (!findkey(kv, "VPN_IP", dovpnip)){
457 fprintf(stderr, "Cannot read VPN_IP\n");
458 }
459 freekeyvalues(kv);
460
461 // Flush all chains.
462 flushChainINPUT(OVPNRED);
463 flushChainINPUT(OVPNBLUE);
464 flushChainINPUT(OVPNORANGE);
465 flushChain(OVPNBLOCK);
466 flushChainNAT(OVPNNAT);
467
468 // set firewall rules
469 if (!strcmp(enablered, "on") && strlen(redif))
470 setChainRules(OVPNRED, redif, protocol, dport);
471 if (!strcmp(enableblue, "on") && strlen(blueif))
472 setChainRules(OVPNBLUE, blueif, protocol, dport);
473 if (!strcmp(enableorange, "on") && strlen(orangeif))
474 setChainRules(OVPNORANGE, orangeif, protocol, dport);
475
476 // read connection configuration
477 connection *conn = getConnections();
478
479 // set firewall rules for n2n connections
480 char command[STRING_SIZE];
481 char *local_subnet_address = NULL;
482 char *transfer_subnet_address = NULL;
483 while (conn != NULL) {
484 if (strcmp(conn->type, "net") == 0) {
485 sprintf(command, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %d -j ACCEPT",
486 OVPNRED, redif, conn->proto, conn->port);
487 executeCommand(command);
488
489 /* Block all communication from the transfer nets. */
490 snprintf(command, STRING_SIZE, "/sbin/iptables -A %s -s %s -j DROP",
491 OVPNBLOCK, conn->transfer_subnet);
492 executeCommand(command);
493
494 local_subnet_address = getLocalSubnetAddress(conn);
495 transfer_subnet_address = calcTransferNetAddress(conn);
496
497 if ((local_subnet_address) && (transfer_subnet_address)) {
498 snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
499 OVPNNAT, transfer_subnet_address, local_subnet_address);
500 executeCommand(command);
501 }
502 }
503
504 conn = conn->next;
505 }
506 }
507
508 void stopDaemon(void) {
509 char command[STRING_SIZE];
510
511 int pid = readPidFile("/var/run/openvpn.pid");
512 if (!pid > 0) {
513 exit(1);
514 }
515
516 fprintf(stderr, "Killing PID %d.\n", pid);
517 kill(pid, SIGTERM);
518
519 snprintf(command, STRING_SIZE - 1, "/bin/rm -f /var/run/openvpn.pid");
520 executeCommand(command);
521 }
522
523 void startDaemon(void) {
524 char command[STRING_SIZE];
525
526 if (!((strcmp(enablered, "on") == 0) || (strcmp(enableblue, "on") == 0) || (strcmp(enableorange, "on") == 0))) {
527 fprintf(stderr, "OpenVPN is not enabled on any interface\n");
528 exit(1);
529 } else {
530 snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
531 executeCommand(command);
532 snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config /var/ipfire/ovpn/server.conf");
533 executeCommand(command);
534 }
535 }
536
537 int startNet2Net(char *name) {
538 connection *conn = NULL;
539 connection *conn_iter;
540
541 conn_iter = getConnections();
542
543 while (conn_iter) {
544 if ((strcmp(conn_iter->type, "net") == 0) && (strcmp(conn_iter->name, name) == 0)) {
545 conn = conn_iter;
546 break;
547 }
548 conn_iter = conn_iter->next;
549 }
550
551 if (conn == NULL) {
552 fprintf(stderr, "Connection not found.\n");
553 return 1;
554 }
555
556 if (strcmp(conn->status, "on") != 0) {
557 fprintf(stderr, "Connection '%s' is not enabled.\n", conn->name);
558 return 1;
559 }
560
561 fprintf(stderr, "Starting connection %s...\n", conn->name);
562
563 char configfile[STRING_SIZE];
564 snprintf(configfile, STRING_SIZE - 1, CONFIG_ROOT "/ovpn/n2nconf/%s/%s.conf",
565 conn->name, conn->name);
566
567 FILE *fp = fopen(configfile, "r");
568 if (fp == NULL) {
569 fprintf(stderr, "Could not find configuration file for connection '%s' at '%s'.\n",
570 conn->name, configfile);
571 return 2;
572 }
573 fclose(fp);
574
575 // Make sure all firewall rules are up to date.
576 setFirewallRules();
577
578 char command[STRING_SIZE];
579 snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
580 executeCommand(command);
581 snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config %s", configfile);
582 executeCommand(command);
583
584 return 0;
585 }
586
587 int killNet2Net(char *name) {
588 connection *conn = NULL;
589 connection *conn_iter;
590
591 conn_iter = getConnections();
592
593 while (conn_iter) {
594 if (strcmp(conn_iter->name, name) == 0) {
595 conn = conn_iter;
596 break;
597 }
598 conn_iter = conn_iter->next;
599 }
600
601 if (conn == NULL) {
602 fprintf(stderr, "Connection not found.\n");
603 return 1;
604 }
605
606 char pidfile[STRING_SIZE];
607 snprintf(pidfile, STRING_SIZE - 1, "/var/run/%sn2n.pid", conn->name);
608
609 int pid = readPidFile(pidfile);
610 if (!pid > 0) {
611 fprintf(stderr, "Could not read pid file of connection %s.", conn->name);
612 return 1;
613 }
614
615 fprintf(stderr, "Killing connection %s (PID %d)...\n", conn->name, pid);
616 kill(pid, SIGTERM);
617
618 char command[STRING_SIZE];
619 snprintf(command, STRING_SIZE - 1, "/bin/rm -f %s", pidfile);
620 executeCommand(command);
621
622 return 0;
623 }
624
625 void startAllNet2Net() {
626 int exitcode = 0, _exitcode = 0;
627
628 connection *conn = getConnections();
629
630 while(conn) {
631 /* Skip all connections that are not of type "net" or disabled. */
632 if ((strcmp(conn->type, "net") != 0) || (strcmp(conn->status, "on") != 0)) {
633 conn = conn->next;
634 continue;
635 }
636
637 _exitcode = startNet2Net(conn->name);
638 conn = conn->next;
639
640 if (_exitcode > exitcode) {
641 exitcode = _exitcode;
642 }
643 }
644
645 exit(exitcode);
646 }
647
648 void killAllNet2Net() {
649 int exitcode = 0, _exitcode = 0;
650
651 connection *conn = getConnections();
652
653 while(conn) {
654 /* Skip all connections that are not of type "net". */
655 if (strcmp(conn->type, "net") != 0) {
656 conn = conn->next;
657 continue;
658 }
659
660 _exitcode = killNet2Net(conn->name);
661 conn = conn->next;
662
663 if (_exitcode > exitcode) {
664 exitcode = _exitcode;
665 }
666 }
667
668 exit(exitcode);
669 }
670
671 void displayopenvpn(void) {
672 char command[STRING_SIZE];
673
674 snprintf(command, STRING_SIZE - 1, "/bin/killall -sSIGUSR2 openvpn");
675 executeCommand(command);
676 }
677
678 int main(int argc, char *argv[]) {
679 if (!(initsetuid()))
680 exit(1);
681 if(argc < 2)
682 usage();
683
684 if(argc == 3) {
685 ovpnInit();
686
687 if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
688 startNet2Net(argv[2]);
689 return 0;
690 }
691 else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
692 killNet2Net(argv[2]);
693 return 0;
694 } else {
695 usage();
696 return 1;
697 }
698 }
699 else if(argc == 2) {
700 if( (strcmp(argv[1], "-k") == 0) || (strcmp(argv[1], "--kill") == 0) ) {
701 stopDaemon();
702 return 0;
703 }
704 else if( (strcmp(argv[1], "-d") == 0) || (strcmp(argv[1], "--display") == 0) ) {
705 displayopenvpn();
706 return 0;
707 }
708 else if( (strcmp(argv[1], "-dcr") == 0) || (strcmp(argv[1], "--delete-chains-and-rules") == 0) ) {
709 deleteAllChains();
710 return 0;
711 }
712 else {
713 ovpnInit();
714
715 if( (strcmp(argv[1], "-s") == 0) || (strcmp(argv[1], "--start") == 0) ) {
716 deleteAllChains();
717 createAllChains();
718 setFirewallRules();
719 startDaemon();
720 return 0;
721 }
722 else if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
723 startAllNet2Net();
724 return 0;
725 }
726 else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
727 killAllNet2Net();
728 return 0;
729 }
730 else if( (strcmp(argv[1], "-sdo") == 0) || (strcmp(argv[1], "--start-daemon-only") == 0) ) {
731 startDaemon();
732 return 0;
733 }
734 else if( (strcmp(argv[1], "-r") == 0) || (strcmp(argv[1], "--restart") == 0) ) {
735 stopDaemon();
736 deleteAllChains();
737 createAllChains();
738 setFirewallRules();
739 startDaemon();
740 return 0;
741 }
742 else if( (strcmp(argv[1], "-fwr") == 0) || (strcmp(argv[1], "--firewall-rules") == 0) ) {
743 deleteAllChains();
744 createAllChains();
745 setFirewallRules();
746 return 0;
747 }
748 else if( (strcmp(argv[1], "-ccr") == 0) || (strcmp(argv[1], "--create-chains-and-rules") == 0) ) {
749 createAllChains();
750 setFirewallRules();
751 return 0;
752 }
753 else {
754 usage();
755 return 0;
756 }
757 }
758 }
759 else {
760 usage();
761 return 0;
762 }
763 return 0;
764 }
765