openvpnctrl: Fixes and improvements.
[people/teissler/ipfire-2.x.git] / src / misc-progs / openvpnctrl.c
1 #include <signal.h>
2 #include <stdio.h>
3 #include <string.h>
4 #include <unistd.h>
5 #include <stdlib.h>
6 #include <sys/types.h>
7 #include <arpa/inet.h>
8 #include <netinet/in.h>
9 #include <fcntl.h>
10 #include "setuid.h"
11 #include "libsmooth.h"
12
13 #define noovpndebug
14
15 // global vars
16 struct keyvalue *kv = NULL;
17 FILE *ifacefile = NULL;
18
19 char redif[STRING_SIZE];
20 char blueif[STRING_SIZE];
21 char orangeif[STRING_SIZE];
22 char enablered[STRING_SIZE] = "off";
23 char enableblue[STRING_SIZE] = "off";
24 char enableorange[STRING_SIZE] = "off";
25
26 // consts
27 char OVPNRED[STRING_SIZE] = "OVPN";
28 char OVPNBLUE[STRING_SIZE] = "OVPN_BLUE_";
29 char OVPNORANGE[STRING_SIZE] = "OVPN_ORANGE_";
30 char OVPNNAT[STRING_SIZE] = "OVPNNAT";
31 char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.3";
32
33 struct connection_struct {
34 char name[STRING_SIZE];
35 char type[STRING_SIZE];
36 char proto[STRING_SIZE];
37 char status[STRING_SIZE];
38 char local_subnet[STRING_SIZE];
39 char transfer_subnet[STRING_SIZE];
40 char role[STRING_SIZE];
41 int port;
42 struct connection_struct *next;
43 };
44
45 typedef struct connection_struct connection;
46
47 void exithandler(void)
48 {
49 if(kv)
50 freekeyvalues(kv);
51 if (ifacefile)
52 fclose(ifacefile);
53 }
54
55 void usage(void)
56 {
57 #ifdef ovpndebug
58 printf("Wrapper for OpenVPN %s-debug\n", WRAPPERVERSION);
59 #else
60 printf("Wrapper for OpenVPN %s\n", WRAPPERVERSION);
61 #endif
62 printf("openvpnctrl <option>\n");
63 printf(" Valid options are:\n");
64 printf(" -s --start\n");
65 printf(" starts OpenVPN (implicitly creates chains and firewall rules)\n");
66 printf(" -k --kill\n");
67 printf(" kills/stops OpenVPN\n");
68 printf(" -r --restart\n");
69 printf(" restarts OpenVPN (implicitly creates chains and firewall rules)\n");
70 printf(" -sn2n --start-net-2-net\n");
71 printf(" starts all net2net connections\n");
72 printf(" you may pass a connection name to the switch to only start a specific one\n");
73 printf(" -kn2n --kill-net-2-net\n");
74 printf(" kills all net2net connections\n");
75 printf(" you may pass a connection name to the switch to only start a specific one\n");
76 printf(" -d --display\n");
77 printf(" displays OpenVPN status to syslog\n");
78 printf(" -fwr --firewall-rules\n");
79 printf(" removes current OpenVPN chains and rules and resets them according to the config\n");
80 printf(" -sdo --start-daemon-only\n");
81 printf(" starts OpenVPN daemon only\n");
82 printf(" -ccr --create-chains-and-rules\n");
83 printf(" creates chains and rules for OpenVPN\n");
84 printf(" -dcr --delete-chains-and-rules\n");
85 printf(" removes all chains for OpenVPN\n");
86 exit(1);
87 }
88
89 connection *getConnections() {
90 FILE *fp = NULL;
91
92 if (!(fp = fopen(CONFIG_ROOT "/ovpn/ovpnconfig", "r"))) {
93 fprintf(stderr, "Could not open openvpn n2n configuration file.\n");
94 exit(1);
95 }
96
97 char line[STRING_SIZE] = "";
98 char result[STRING_SIZE] = "";
99 char *resultptr;
100 int count;
101 connection *conn_first = NULL;
102 connection *conn_last = NULL;
103 connection *conn_curr;
104
105 while ((fgets(line, STRING_SIZE, fp) != NULL)) {
106 if (line[strlen(line) - 1] == '\n')
107 line[strlen(line) - 1] = '\0';
108
109 conn_curr = (connection *)malloc(sizeof(connection));
110 memset(conn_curr, 0, sizeof(connection));
111
112 if (conn_first == NULL) {
113 conn_first = conn_curr;
114 } else {
115 conn_last->next = conn_curr;
116 }
117 conn_last = conn_curr;
118
119 count = 0;
120 char *lineptr = &line;
121 while (1) {
122 if (*lineptr == NULL)
123 break;
124
125 resultptr = result;
126 while (*lineptr != NULL) {
127 if (*lineptr == ',') {
128 lineptr++;
129 break;
130 }
131 *resultptr++ = *lineptr++;
132 }
133 *resultptr = '\0';
134
135 if (count == 1) {
136 strcpy(conn_curr->status, result);
137 } else if (count == 2) {
138 strcpy(conn_curr->name, result);
139 } else if (count == 4) {
140 strcpy(conn_curr->type, result);
141 } else if (count == 7) {
142 strcpy(conn_curr->role, result);
143 } else if (count == 9) {
144 strcpy(conn_curr->local_subnet, result);
145 } else if (count == 28) {
146 strcpy(conn_curr->transfer_subnet, result);
147 } else if (count == 29) {
148 strcpy(conn_curr->proto, result);
149 } else if (count == 30) {
150 conn_curr->port = atoi(result);
151 }
152
153 count++;
154 }
155 }
156
157 fclose(fp);
158
159 return conn_first;
160 }
161
162 int readPidFile(const char *pidfile) {
163 FILE *fp = fopen(pidfile, "r");
164 if (fp == NULL) {
165 fprintf(stderr, "PID file not found: '%s'\n", pidfile);
166 exit(1);
167 }
168
169 int pid = 0;
170 fscanf(fp, "%d", &pid);
171 fclose(fp);
172
173 return pid;
174 }
175
176 void ovpnInit(void) {
177
178 // Read OpenVPN configuration
179 kv = initkeyvalues();
180 if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings")) {
181 fprintf(stderr, "Cannot read ovpn settings\n");
182 exit(1);
183 }
184
185 if (!findkey(kv, "ENABLED", enablered)) {
186 fprintf(stderr, "Cannot read ENABLED\n");
187 exit(1);
188 }
189
190 if (!findkey(kv, "ENABLED_BLUE", enableblue)){
191 fprintf(stderr, "Cannot read ENABLED_BLUE\n");
192 exit(1);
193 }
194
195 if (!findkey(kv, "ENABLED_ORANGE", enableorange)){
196 fprintf(stderr, "Cannot read ENABLED_ORANGE\n");
197 exit(1);
198 }
199 freekeyvalues(kv);
200
201 // read interface settings
202
203 // details for the red int
204 memset(redif, 0, STRING_SIZE);
205 if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r")))
206 {
207 if (fgets(redif, STRING_SIZE, ifacefile))
208 {
209 if (redif[strlen(redif) - 1] == '\n')
210 redif[strlen(redif) - 1] = '\0';
211 }
212 fclose (ifacefile);
213 ifacefile = NULL;
214
215 if (!VALID_DEVICE(redif))
216 {
217 memset(redif, 0, STRING_SIZE);
218 }
219 }
220
221 kv=initkeyvalues();
222 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
223 {
224 fprintf(stderr, "Cannot read ethernet settings\n");
225 exit(1);
226 }
227
228 if (strcmp(enableblue, "on")==0){
229 if (!findkey(kv, "BLUE_DEV", blueif)){
230 fprintf(stderr, "Cannot read BLUE_DEV\n");
231 exit(1);
232 }
233 }
234 if (strcmp(enableorange, "on")==0){
235 if (!findkey(kv, "ORANGE_DEV", orangeif)){
236 fprintf(stderr, "Cannot read ORNAGE_DEV\n");
237 exit(1);
238 }
239 }
240 freekeyvalues(kv);
241 }
242
243 void executeCommand(char *command) {
244 #ifdef ovpndebug
245 printf(strncat(command, "\n", 2));
246 #endif
247 safe_system(strncat(command, " >/dev/null 2>&1", 17));
248 }
249
250 void setChainRules(char *chain, char *interface, char *protocol, char *port)
251 {
252 char str[STRING_SIZE];
253
254 sprintf(str, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %s -j ACCEPT", chain, interface, protocol, port);
255 executeCommand(str);
256 sprintf(str, "/sbin/iptables -A %sINPUT -i tun+ -j ACCEPT", chain);
257 executeCommand(str);
258 sprintf(str, "/sbin/iptables -A %sFORWARD -i tun+ -j ACCEPT", chain);
259 executeCommand(str);
260 }
261
262 void flushChain(char *chain) {
263 char str[STRING_SIZE];
264
265 sprintf(str, "/sbin/iptables -F %sINPUT", chain);
266 executeCommand(str);
267 sprintf(str, "/sbin/iptables -F %sFORWARD", chain);
268 executeCommand(str);
269 safe_system(str);
270 }
271
272 void flushChainNAT(char *chain) {
273 char str[STRING_SIZE];
274
275 sprintf(str, "/sbin/iptables -t nat -F %s", chain);
276 executeCommand(str);
277 }
278
279 void deleteChainReference(char *chain) {
280 char str[STRING_SIZE];
281
282 sprintf(str, "/sbin/iptables -D INPUT -j %sINPUT", chain);
283 executeCommand(str);
284 safe_system(str);
285 sprintf(str, "/sbin/iptables -D FORWARD -j %sFORWARD", chain);
286 executeCommand(str);
287 safe_system(str);
288 }
289
290 void deleteChain(char *chain) {
291 char str[STRING_SIZE];
292
293 sprintf(str, "/sbin/iptables -X %sINPUT", chain);
294 executeCommand(str);
295 sprintf(str, "/sbin/iptables -X %sFORWARD", chain);
296 executeCommand(str);
297 }
298
299 void deleteAllChains(void) {
300 // not an elegant solution, but to avoid timing problems with undeleted chain references
301 deleteChainReference(OVPNRED);
302 deleteChainReference(OVPNBLUE);
303 deleteChainReference(OVPNORANGE);
304 flushChain(OVPNRED);
305 flushChain(OVPNBLUE);
306 flushChain(OVPNORANGE);
307 deleteChain(OVPNRED);
308 deleteChain(OVPNBLUE);
309 deleteChain(OVPNORANGE);
310 }
311
312 void createChainReference(char *chain) {
313 char str[STRING_SIZE];
314 sprintf(str, "/sbin/iptables -I INPUT %s -j %sINPUT", "14", chain);
315 executeCommand(str);
316 sprintf(str, "/sbin/iptables -I FORWARD %s -j %sFORWARD", "12", chain);
317 executeCommand(str);
318 }
319
320 void createChain(char *chain) {
321 char str[STRING_SIZE];
322 sprintf(str, "/sbin/iptables -N %sINPUT", chain);
323 executeCommand(str);
324 sprintf(str, "/sbin/iptables -N %sFORWARD", chain);
325 executeCommand(str);
326 }
327
328 void createAllChains(void) {
329 // create chain and chain references
330 if (!strcmp(enableorange, "on")) {
331 if (strlen(orangeif)) {
332 createChain(OVPNORANGE);
333 createChainReference(OVPNORANGE);
334 } else {
335 fprintf(stderr, "OpenVPN enabled on orange but no orange interface found\n");
336 //exit(1);
337 }
338 }
339
340 if (!strcmp(enableblue, "on")) {
341 if (strlen(blueif)) {
342 createChain(OVPNBLUE);
343 createChainReference(OVPNBLUE);
344 } else {
345 fprintf(stderr, "OpenVPN enabled on blue but no blue interface found\n");
346 //exit(1);
347 }
348 }
349
350 if (!strcmp(enablered, "on")) {
351 if (strlen(redif)) {
352 createChain(OVPNRED);
353 createChainReference(OVPNRED);
354 } else {
355 fprintf(stderr, "OpenVPN enabled on red but no red interface found\n");
356 //exit(1);
357 }
358 }
359 }
360
361 char* calcTransferNetAddress(const connection* conn) {
362 char *subnetmask = strdup(conn->transfer_subnet);
363 char *address = strsep(&subnetmask, "/");
364
365 in_addr_t _address = inet_addr(address);
366 in_addr_t _subnetmask = inet_addr(subnetmask);
367 _address &= _subnetmask;
368
369 if (strcmp(conn->role, "server") == 0) {
370 _address += 1 << 24;
371 } else if (strcmp(conn->role, "client") == 0) {
372 _address += 2 << 24;
373 } else {
374 goto ERROR;
375 }
376
377 struct in_addr address_info;
378 address_info.s_addr = _address;
379
380 return inet_ntoa(address_info);
381
382 ERROR:
383 fprintf(stderr, "Could not determine transfer net address: %s\n", conn->name);
384
385 free(address);
386 return NULL;
387 }
388
389 char* getLocalSubnetAddress(const connection* conn) {
390 kv = initkeyvalues();
391 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
392 fprintf(stderr, "Cannot read ethernet settings\n");
393 exit(1);
394 }
395
396 const char *zones[] = {"GREEN", "BLUE", "ORANGE", NULL};
397 char *zone = NULL;
398
399 // Get net address of the local openvpn subnet.
400 char *subnetmask = strdup(conn->local_subnet);
401 char *address = strsep(&subnetmask, "/");
402
403 if ((address == NULL) || (subnetmask == NULL)) {
404 goto ERROR;
405 }
406
407 in_addr_t _address = inet_addr(address);
408 in_addr_t _subnetmask = inet_addr(subnetmask);
409
410 in_addr_t _netaddr = (_address & _subnetmask);
411 in_addr_t _broadcast = (_address | ~_subnetmask);
412
413 char zone_address_key[STRING_SIZE];
414 char zone_address[STRING_SIZE];
415 in_addr_t zone_addr;
416
417 int i = 0;
418 while (zones[i]) {
419 zone = zones[i++];
420 snprintf(zone_address_key, STRING_SIZE, "%s_ADDRESS", zone);
421
422 if (!findkey(kv, zone_address_key, zone_address))
423 continue;
424
425 zone_addr = inet_addr(zone_address);
426 if ((zone_addr > _netaddr) && (zone_addr < _broadcast)) {
427 freekeyvalues(kv);
428
429 return strdup(zone_address);
430 }
431 }
432
433 ERROR:
434 fprintf(stderr, "Could not determine local subnet address: %s\n", conn->name);
435
436 freekeyvalues(kv);
437 return NULL;
438 }
439
440 void setFirewallRules(void) {
441 char protocol[STRING_SIZE] = "";
442 char dport[STRING_SIZE] = "";
443 char dovpnip[STRING_SIZE] = "";
444
445 kv = initkeyvalues();
446 if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings"))
447 {
448 fprintf(stderr, "Cannot read ovpn settings\n");
449 exit(1);
450 }
451
452 /* we got one device, so lets proceed further */
453 if (!findkey(kv, "DDEST_PORT", dport)){
454 fprintf(stderr, "Cannot read DDEST_PORT\n");
455 exit(1);
456 }
457
458 if (!findkey(kv, "DPROTOCOL", protocol)){
459 fprintf(stderr, "Cannot read DPROTOCOL\n");
460 exit(1);
461 }
462
463 if (!findkey(kv, "VPN_IP", dovpnip)){
464 fprintf(stderr, "Cannot read VPN_IP\n");
465 // exit(1); step further as we don't need an ip
466 }
467 freekeyvalues(kv);
468
469 // Flush all chains.
470 flushChain(OVPNRED);
471 flushChain(OVPNBLUE);
472 flushChain(OVPNORANGE);
473 flushChainNAT(OVPNNAT);
474
475 // set firewall rules
476 if (!strcmp(enablered, "on") && strlen(redif))
477 setChainRules(OVPNRED, redif, protocol, dport);
478 if (!strcmp(enableblue, "on") && strlen(blueif))
479 setChainRules(OVPNBLUE, blueif, protocol, dport);
480 if (!strcmp(enableorange, "on") && strlen(orangeif))
481 setChainRules(OVPNORANGE, orangeif, protocol, dport);
482
483 // read connection configuration
484 connection *conn = getConnections();
485
486 // set firewall rules for n2n connections
487 char command[STRING_SIZE];
488 char *local_subnet_address = NULL;
489 char *transfer_subnet_address = NULL;
490 while (conn != NULL) {
491 if (strcmp(conn->type, "net") == 0) {
492 sprintf(command, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %d -j ACCEPT",
493 OVPNRED, redif, conn->proto, conn->port);
494 executeCommand(command);
495
496 local_subnet_address = getLocalSubnetAddress(conn);
497 transfer_subnet_address = calcTransferNetAddress(conn);
498
499 if ((!local_subnet_address) || (!transfer_subnet_address))
500 continue;
501
502 snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
503 OVPNNAT, transfer_subnet_address, local_subnet_address);
504 executeCommand(command);
505 }
506
507 conn = conn->next;
508 }
509 }
510
511 void stopDaemon(void) {
512 char command[STRING_SIZE];
513
514 int pid = readPidFile("/var/run/openvpn.pid");
515 if (!pid > 0) {
516 exit(1);
517 }
518
519 fprintf(stderr, "Killing PID %d.\n", pid);
520 kill(pid, SIGTERM);
521
522 snprintf(command, STRING_SIZE - 1, "/bin/rm -f /var/run/openvpn.pid");
523 executeCommand(command);
524 }
525
526 void startDaemon(void) {
527 char command[STRING_SIZE];
528
529 if (!((strcmp(enablered, "on")==0) || (strcmp(enableblue, "on")==0) || (strcmp(enableorange, "on")==0))){
530 fprintf(stderr, "OpenVPN is not enabled on any interface\n");
531 exit(1);
532 } else {
533 snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
534 executeCommand(command);
535 snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config /var/ipfire/ovpn/server.conf");
536 executeCommand(command);
537 }
538 }
539
540 int startNet2Net(char *name) {
541 connection *conn = NULL;
542 connection *conn_iter;
543
544 conn_iter = getConnections();
545
546 while (conn_iter) {
547 if ((strcmp(conn_iter->type, "net") == 0) && (strcmp(conn_iter->name, name) == 0)) {
548 conn = conn_iter;
549 break;
550 }
551 conn_iter = conn_iter->next;
552 }
553
554 if (conn == NULL) {
555 fprintf(stderr, "Connection not found.\n");
556 return 1;
557 }
558
559 if (strcmp(conn->status, "on") != 0) {
560 fprintf(stderr, "Connection '%s' is not enabled.\n", conn->name);
561 return 1;
562 }
563
564 fprintf(stderr, "Starting connection %s...\n", conn->name);
565
566 char configfile[STRING_SIZE];
567 snprintf(configfile, STRING_SIZE - 1, CONFIG_ROOT "/ovpn/n2nconf/%s/%s.conf",
568 conn->name, conn->name);
569
570 FILE *fp = fopen(configfile, "r");
571 if (fp == NULL) {
572 fprintf(stderr, "Could not find configuration file for connection '%s' at '%s'.\n",
573 conn->name, configfile);
574 return 2;
575 }
576 fclose(fp);
577
578 // Make sure all firewall rules are up to date.
579 setFirewallRules();
580
581 char command[STRING_SIZE];
582 snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
583 executeCommand(command);
584 snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config %s", configfile);
585 executeCommand(command);
586
587 return 0;
588 }
589
590 int killNet2Net(char *name) {
591 connection *conn = NULL;
592 connection *conn_iter;
593
594 conn_iter = getConnections();
595
596 while (conn_iter) {
597 if (strcmp(conn_iter->name, name) == 0) {
598 conn = conn_iter;
599 break;
600 }
601 conn_iter = conn_iter->next;
602 }
603
604 if (conn == NULL) {
605 fprintf(stderr, "Connection not found.\n");
606 return 1;
607 }
608
609 char pidfile[STRING_SIZE];
610 snprintf(pidfile, STRING_SIZE - 1, "/var/run/%sn2n.pid", conn->name);
611
612 int pid = readPidFile(pidfile);
613 if (!pid > 0) {
614 fprintf(stderr, "Could not read pid file of connection %s.", conn->name);
615 return 1;
616 }
617
618 fprintf(stderr, "Killing connection %s (PID %d)...\n", conn->name, pid);
619 kill(pid, SIGTERM);
620
621 char command[STRING_SIZE];
622 snprintf(command, STRING_SIZE - 1, "/bin/rm -f %s", pidfile);
623 executeCommand(command);
624
625 return 0;
626 }
627
628 void startAllNet2Net() {
629 int exitcode = 0, _exitcode = 0;
630
631 connection *conn = getConnections();
632
633 while(conn) {
634 /* Skip all connections that are not of type "net" or disabled. */
635 if ((strcmp(conn->type, "net") != 0) || (strcmp(conn->status, "on") != 0)) {
636 conn = conn->next;
637 continue;
638 }
639
640 _exitcode = startNet2Net(conn->name);
641 conn = conn->next;
642
643 if (_exitcode > exitcode) {
644 exitcode = _exitcode;
645 }
646 }
647
648 exit(exitcode);
649 }
650
651 void killAllNet2Net() {
652 int exitcode = 0, _exitcode = 0;
653
654 connection *conn = getConnections();
655
656 while(conn) {
657 /* Skip all connections that are not of type "net". */
658 if (strcmp(conn->type, "net") != 0) {
659 conn = conn->next;
660 continue;
661 }
662
663 _exitcode = killNet2Net(conn->name);
664 conn = conn->next;
665
666 if (_exitcode > exitcode) {
667 exitcode = _exitcode;
668 }
669 }
670
671 exit(exitcode);
672 }
673
674 void displayopenvpn(void) {
675 char command[STRING_SIZE];
676
677 snprintf(command, STRING_SIZE - 1, "/bin/killall -sSIGUSR2 openvpn");
678 executeCommand(command);
679 }
680
681 int main(int argc, char *argv[]) {
682 if (!(initsetuid()))
683 exit(1);
684 if(argc < 2)
685 usage();
686
687 if(argc == 3) {
688 ovpnInit();
689
690 if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
691 startNet2Net(argv[2]);
692 return 0;
693 }
694 else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
695 killNet2Net(argv[2]);
696 return 0;
697 } else {
698 usage();
699 return 1;
700 }
701 }
702 else if(argc == 2) {
703 if( (strcmp(argv[1], "-k") == 0) || (strcmp(argv[1], "--kill") == 0) ) {
704 stopDaemon();
705 return 0;
706 }
707 else if( (strcmp(argv[1], "-d") == 0) || (strcmp(argv[1], "--display") == 0) ) {
708 displayopenvpn();
709 return 0;
710 }
711 else if( (strcmp(argv[1], "-dcr") == 0) || (strcmp(argv[1], "--delete-chains-and-rules") == 0) ) {
712 deleteAllChains();
713 return 0;
714 }
715 else {
716 ovpnInit();
717
718 if( (strcmp(argv[1], "-s") == 0) || (strcmp(argv[1], "--start") == 0) ) {
719 deleteAllChains();
720 createAllChains();
721 setFirewallRules();
722 startDaemon();
723 return 0;
724 }
725 else if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
726 startAllNet2Net();
727 return 0;
728 }
729 else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
730 killAllNet2Net();
731 return 0;
732 }
733 else if( (strcmp(argv[1], "-sdo") == 0) || (strcmp(argv[1], "--start-daemon-only") == 0) ) {
734 startDaemon();
735 return 0;
736 }
737 else if( (strcmp(argv[1], "-r") == 0) || (strcmp(argv[1], "--restart") == 0) ) {
738 stopDaemon();
739 deleteAllChains();
740 createAllChains();
741 setFirewallRules();
742 startDaemon();
743 return 0;
744 }
745 else if( (strcmp(argv[1], "-fwr") == 0) || (strcmp(argv[1], "--firewall-rules") == 0) ) {
746 deleteAllChains();
747 createAllChains();
748 setFirewallRules();
749 return 0;
750 }
751 else if( (strcmp(argv[1], "-ccr") == 0) || (strcmp(argv[1], "--create-chains-and-rules") == 0) ) {
752 createAllChains();
753 setFirewallRules();
754 return 0;
755 }
756 else {
757 usage();
758 return 0;
759 }
760 }
761 }
762 else {
763 usage();
764 return 0;
765 }
766 return 0;
767 }
768