misc-progs: Move network stuff to own header file.

[people/teissler/ipfire-2.x.git] / src / misc-progs / openvpnctrl.c

diff --git a/src/misc-progs/openvpnctrl.c b/src/misc-progs/openvpnctrl.c
index e366294b572ab796e54fc6deb196e920af27365d..257778892a1868bdb302614de2a1fcc970b3d619 100644 (file)
--- a/src/misc-progs/openvpnctrl.c
+++ b/src/misc-progs/openvpnctrl.c
@@ -8,6 +8,7 @@
 #include <netinet/in.h>
 #include <fcntl.h>
 #include "setuid.h"
+#include "netutil.h"
 #include "libsmooth.h"
 
 #define noovpndebug
@@ -27,6 +28,7 @@ char enableorange[STRING_SIZE] = "off";
 char OVPNRED[STRING_SIZE] = "OVPN";
 char OVPNBLUE[STRING_SIZE] = "OVPN_BLUE_";
 char OVPNORANGE[STRING_SIZE] = "OVPN_ORANGE_";
+char OVPNBLOCK[STRING_SIZE] = "OVPNBLOCK";
 char OVPNNAT[STRING_SIZE] = "OVPNNAT";
 char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.3";
 
@@ -162,7 +164,6 @@ connection *getConnections() {
 int readPidFile(const char *pidfile) {
        FILE *fp = fopen(pidfile, "r");
        if (fp == NULL) {
-               fprintf(stderr, "PID file not found: '%s'\n", pidfile);
                exit(1);
        }
 
@@ -174,7 +175,6 @@ int readPidFile(const char *pidfile) {
 }
 
 void ovpnInit(void) {
-       
        // Read OpenVPN configuration
        kv = initkeyvalues();
        if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings")) {
@@ -183,17 +183,14 @@ void ovpnInit(void) {
        }
 
        if (!findkey(kv, "ENABLED", enablered)) {
-               fprintf(stderr, "Cannot read ENABLED\n");
                exit(1);
        }
 
        if (!findkey(kv, "ENABLED_BLUE", enableblue)){
-               fprintf(stderr, "Cannot read ENABLED_BLUE\n");
                exit(1);
        }
 
        if (!findkey(kv, "ENABLED_ORANGE", enableorange)){
-               fprintf(stderr, "Cannot read ENABLED_ORANGE\n");
                exit(1);
        }
        freekeyvalues(kv);
@@ -219,24 +216,22 @@ void ovpnInit(void) {
        }
 
        kv=initkeyvalues();
-       if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
-       {
+       if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
                fprintf(stderr, "Cannot read ethernet settings\n");
                exit(1);
        }
        
-       if (strcmp(enableblue, "on")==0){
-               if (!findkey(kv, "BLUE_DEV", blueif)){
-                       fprintf(stderr, "Cannot read BLUE_DEV\n");
+       if (strcmp(enableblue, "on") == 0) {
+               if (!findkey(kv, "BLUE_DEV", blueif)) {
                        exit(1);
                }
        }
-       if (strcmp(enableorange, "on")==0){
-               if (!findkey(kv, "ORANGE_DEV", orangeif)){
-                       fprintf(stderr, "Cannot read ORNAGE_DEV\n");
+
+       if (strcmp(enableorange, "on") == 0) {
+               if (!findkey(kv, "ORANGE_DEV", orangeif)) {
                        exit(1);
                }
-       }               
+       }
        freekeyvalues(kv);
 }
 
@@ -253,20 +248,13 @@ void setChainRules(char *chain, char *interface, char *protocol, char *port)
 
        sprintf(str, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %s -j ACCEPT", chain, interface, protocol, port);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -A %sINPUT -i tun+ -j ACCEPT", chain);
-       executeCommand(str);
-       sprintf(str, "/sbin/iptables -A %sFORWARD -i tun+ -j ACCEPT", chain);
-       executeCommand(str);
 }
 
 void flushChain(char *chain) {
        char str[STRING_SIZE];
 
-       sprintf(str, "/sbin/iptables -F %sINPUT", chain);
+       sprintf(str, "/sbin/iptables -F %s", chain);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -F %sFORWARD", chain);
-       executeCommand(str);
-       safe_system(str);
 }
 
 void flushChainNAT(char *chain) {
@@ -276,15 +264,18 @@ void flushChainNAT(char *chain) {
        executeCommand(str);
 }
 
+void flushChainINPUT(char *chain) {
+       char str[STRING_SIZE];
+
+       snprintf(str, STRING_SIZE, "%sINPUT", chain);
+       flushChain(str);
+}
+
 void deleteChainReference(char *chain) {
        char str[STRING_SIZE];
 
        sprintf(str, "/sbin/iptables -D INPUT -j %sINPUT", chain);
        executeCommand(str);
-       safe_system(str);
-       sprintf(str, "/sbin/iptables -D FORWARD -j %sFORWARD", chain);
-       executeCommand(str);
-       safe_system(str);
 }
 
 void deleteChain(char *chain) {
@@ -292,8 +283,6 @@ void deleteChain(char *chain) {
 
        sprintf(str, "/sbin/iptables -X %sINPUT", chain);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -X %sFORWARD", chain);
-       executeCommand(str);
 }
 
 void deleteAllChains(void) {
@@ -301,34 +290,34 @@ void deleteAllChains(void) {
        deleteChainReference(OVPNRED);
        deleteChainReference(OVPNBLUE);
        deleteChainReference(OVPNORANGE);
-       flushChain(OVPNRED);
-       flushChain(OVPNBLUE);
-       flushChain(OVPNORANGE);
+       flushChainINPUT(OVPNRED);
+       flushChainINPUT(OVPNBLUE);
+       flushChainINPUT(OVPNORANGE);
        deleteChain(OVPNRED);
        deleteChain(OVPNBLUE);
        deleteChain(OVPNORANGE);
+
+       // Only flush chains that are created by the firewall
+       flushChain(OVPNBLOCK);
+       flushChainNAT(OVPNNAT);
 }
 
 void createChainReference(char *chain) {
        char str[STRING_SIZE];
        sprintf(str, "/sbin/iptables -I INPUT %s -j %sINPUT", "14", chain);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -I FORWARD %s -j %sFORWARD", "12", chain);
-       executeCommand(str);
 }
 
 void createChain(char *chain) {
        char str[STRING_SIZE];
        sprintf(str, "/sbin/iptables -N %sINPUT", chain);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -N %sFORWARD", chain);
-       executeCommand(str);
 }
 
 void createAllChains(void) {
        // create chain and chain references
        if (!strcmp(enableorange, "on")) {
-               if (strlen(orangeif)) {
+               if (strlen(orangeif) > 0) {
                        createChain(OVPNORANGE);
                        createChainReference(OVPNORANGE);
                } else {
@@ -338,7 +327,7 @@ void createAllChains(void) {
        }
 
        if (!strcmp(enableblue, "on")) {
-               if (strlen(blueif)) {
+               if (strlen(blueif) > 0) {
                        createChain(OVPNBLUE);
                        createChainReference(OVPNBLUE);
                } else {
@@ -348,7 +337,7 @@ void createAllChains(void) {
        }
 
        if (!strcmp(enablered, "on")) {
-               if (strlen(redif)) {
+               if (strlen(redif) > 0) {
                        createChain(OVPNRED);
                        createChainReference(OVPNRED);
                } else {
@@ -362,6 +351,10 @@ char* calcTransferNetAddress(const connection* conn) {
        char *subnetmask = strdup(conn->transfer_subnet);
        char *address = strsep(&subnetmask, "/");
 
+       if ((address == NULL) || (subnetmask == NULL)) {
+               goto ERROR;
+       }
+
        in_addr_t _address    = inet_addr(address);
        in_addr_t _subnetmask = inet_addr(subnetmask);
        _address &= _subnetmask;
@@ -462,14 +455,14 @@ void setFirewallRules(void) {
 
        if (!findkey(kv, "VPN_IP", dovpnip)){
                fprintf(stderr, "Cannot read VPN_IP\n");
-//             exit(1); step further as we don't need an ip
        }
        freekeyvalues(kv);
 
        // Flush all chains.
-       flushChain(OVPNRED);
-       flushChain(OVPNBLUE);
-       flushChain(OVPNORANGE);
+       flushChainINPUT(OVPNRED);
+       flushChainINPUT(OVPNBLUE);
+       flushChainINPUT(OVPNORANGE);
+       flushChain(OVPNBLOCK);
        flushChainNAT(OVPNNAT);
 
        // set firewall rules
@@ -493,15 +486,19 @@ void setFirewallRules(void) {
                                OVPNRED, redif, conn->proto, conn->port);
                        executeCommand(command);
 
+                       /* Block all communication from the transfer nets. */
+                       snprintf(command, STRING_SIZE, "/sbin/iptables -A %s -s %s -j DROP",
+                               OVPNBLOCK, conn->transfer_subnet);
+                       executeCommand(command);
+
                        local_subnet_address = getLocalSubnetAddress(conn);
                        transfer_subnet_address = calcTransferNetAddress(conn);
 
-                       if ((!local_subnet_address) || (!transfer_subnet_address))
-                               continue;
-
-                       snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
-                               OVPNNAT, transfer_subnet_address, local_subnet_address);
-                       executeCommand(command);
+                       if ((local_subnet_address) && (transfer_subnet_address)) {
+                               snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
+                                       OVPNNAT, transfer_subnet_address, local_subnet_address);
+                               executeCommand(command);
+                       }
                }
 
                conn = conn->next;
@@ -526,7 +523,7 @@ void stopDaemon(void) {
 void startDaemon(void) {
        char command[STRING_SIZE];
        
-       if (!((strcmp(enablered, "on")==0) || (strcmp(enableblue, "on")==0) || (strcmp(enableorange, "on")==0))){
+       if (!((strcmp(enablered, "on") == 0) || (strcmp(enableblue, "on") == 0) || (strcmp(enableorange, "on") == 0))) {
                fprintf(stderr, "OpenVPN is not enabled on any interface\n");
                exit(1);
        } else {