#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
#include <fcntl.h>
#include "setuid.h"
#include "libsmooth.h"
char OVPNRED[STRING_SIZE] = "OVPN";
char OVPNBLUE[STRING_SIZE] = "OVPN_BLUE_";
char OVPNORANGE[STRING_SIZE] = "OVPN_ORANGE_";
-char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.1";
+char OVPNNAT[STRING_SIZE] = "OVPNNAT";
+char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.3";
struct connection_struct {
char name[STRING_SIZE];
char type[STRING_SIZE];
char proto[STRING_SIZE];
+ char status[STRING_SIZE];
+ char local_subnet[STRING_SIZE];
+ char transfer_subnet[STRING_SIZE];
+ char role[STRING_SIZE];
int port;
struct connection_struct *next;
};
}
*resultptr = '\0';
- if (count == 2) {
+ if (count == 1) {
+ strcpy(conn_curr->status, result);
+ } else if (count == 2) {
strcpy(conn_curr->name, result);
} else if (count == 4) {
strcpy(conn_curr->type, result);
+ } else if (count == 7) {
+ strcpy(conn_curr->role, result);
+ } else if (count == 9) {
+ strcpy(conn_curr->local_subnet, result);
+ } else if (count == 28) {
+ strcpy(conn_curr->transfer_subnet, result);
} else if (count == 29) {
strcpy(conn_curr->proto, result);
} else if (count == 30) {
safe_system(str);
}
+void flushChainNAT(char *chain) {
+ char str[STRING_SIZE];
+
+ sprintf(str, "/sbin/iptables -t nat -F %s", chain);
+ executeCommand(str);
+}
+
void deleteChainReference(char *chain) {
char str[STRING_SIZE];
}
}
+char* calcTransferNetAddress(const connection* conn) {
+ char *subnetmask = strdup(conn->transfer_subnet);
+ char *address = strsep(&subnetmask, "/");
+
+ in_addr_t _address = inet_addr(address);
+ in_addr_t _subnetmask = inet_addr(subnetmask);
+ _address &= _subnetmask;
+
+ if (strcmp(conn->role, "server") == 0) {
+ _address += 1 << 24;
+ } else if (strcmp(conn->role, "client") == 0) {
+ _address += 2 << 24;
+ } else {
+ goto ERROR;
+ }
+
+ struct in_addr address_info;
+ address_info.s_addr = _address;
+
+ return inet_ntoa(address_info);
+
+ERROR:
+ fprintf(stderr, "Could not determine transfer net address: %s\n", conn->name);
+
+ free(address);
+ return NULL;
+}
+
+char* getLocalSubnetAddress(const connection* conn) {
+ kv = initkeyvalues();
+ if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
+ fprintf(stderr, "Cannot read ethernet settings\n");
+ exit(1);
+ }
+
+ const char *zones[] = {"GREEN", "BLUE", "ORANGE", NULL};
+ char *zone = NULL;
+
+ // Get net address of the local openvpn subnet.
+ char *subnetmask = strdup(conn->local_subnet);
+ char *address = strsep(&subnetmask, "/");
+
+ if ((address == NULL) || (subnetmask == NULL)) {
+ goto ERROR;
+ }
+
+ in_addr_t _address = inet_addr(address);
+ in_addr_t _subnetmask = inet_addr(subnetmask);
+
+ in_addr_t _netaddr = (_address & _subnetmask);
+ in_addr_t _broadcast = (_address | ~_subnetmask);
+
+ char zone_address_key[STRING_SIZE];
+ char zone_address[STRING_SIZE];
+ in_addr_t zone_addr;
+
+ int i = 0;
+ while (zones[i]) {
+ zone = zones[i++];
+ snprintf(zone_address_key, STRING_SIZE, "%s_ADDRESS", zone);
+
+ if (!findkey(kv, zone_address_key, zone_address))
+ continue;
+
+ zone_addr = inet_addr(zone_address);
+ if ((zone_addr > _netaddr) && (zone_addr < _broadcast)) {
+ freekeyvalues(kv);
+
+ return strdup(zone_address);
+ }
+ }
+
+ERROR:
+ fprintf(stderr, "Could not determine local subnet address: %s\n", conn->name);
+
+ freekeyvalues(kv);
+ return NULL;
+}
+
void setFirewallRules(void) {
char protocol[STRING_SIZE] = "";
char dport[STRING_SIZE] = "";
flushChain(OVPNRED);
flushChain(OVPNBLUE);
flushChain(OVPNORANGE);
+ flushChainNAT(OVPNNAT);
// set firewall rules
if (!strcmp(enablered, "on") && strlen(redif))
// set firewall rules for n2n connections
char command[STRING_SIZE];
+ char *local_subnet_address = NULL;
+ char *transfer_subnet_address = NULL;
while (conn != NULL) {
if (strcmp(conn->type, "net") == 0) {
sprintf(command, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %d -j ACCEPT",
OVPNRED, redif, conn->proto, conn->port);
executeCommand(command);
+
+ local_subnet_address = getLocalSubnetAddress(conn);
+ transfer_subnet_address = calcTransferNetAddress(conn);
+
+ if ((!local_subnet_address) || (!transfer_subnet_address))
+ continue;
+
+ snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
+ OVPNNAT, transfer_subnet_address, local_subnet_address);
+ executeCommand(command);
}
conn = conn->next;
}
}
-void startNet2Net(char *name) {
+int startNet2Net(char *name) {
connection *conn = NULL;
connection *conn_iter;
if (conn == NULL) {
fprintf(stderr, "Connection not found.\n");
- exit(1);
+ return 1;
}
+ if (strcmp(conn->status, "on") != 0) {
+ fprintf(stderr, "Connection '%s' is not enabled.\n", conn->name);
+ return 1;
+ }
+
+ fprintf(stderr, "Starting connection %s...\n", conn->name);
+
char configfile[STRING_SIZE];
snprintf(configfile, STRING_SIZE - 1, CONFIG_ROOT "/ovpn/n2nconf/%s/%s.conf",
conn->name, conn->name);
if (fp == NULL) {
fprintf(stderr, "Could not find configuration file for connection '%s' at '%s'.\n",
conn->name, configfile);
- exit(2);
+ return 2;
}
fclose(fp);
executeCommand(command);
snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config %s", configfile);
executeCommand(command);
+
+ return 0;
}
-void killNet2Net(char *name) {
+int killNet2Net(char *name) {
connection *conn = NULL;
connection *conn_iter;
if (conn == NULL) {
fprintf(stderr, "Connection not found.\n");
- exit(1);
+ return 1;
}
char pidfile[STRING_SIZE];
int pid = readPidFile(pidfile);
if (!pid > 0) {
- exit(1);
+ fprintf(stderr, "Could not read pid file of connection %s.", conn->name);
+ return 1;
}
- fprintf(stderr, "Killing PID %d.\n", pid);
+ fprintf(stderr, "Killing connection %s (PID %d)...\n", conn->name, pid);
kill(pid, SIGTERM);
char command[STRING_SIZE];
snprintf(command, STRING_SIZE - 1, "/bin/rm -f %s", pidfile);
executeCommand(command);
- exit(0);
+ return 0;
}
void startAllNet2Net() {
+ int exitcode = 0, _exitcode = 0;
+
connection *conn = getConnections();
while(conn) {
- startNet2Net(conn->name);
+ /* Skip all connections that are not of type "net" or disabled. */
+ if ((strcmp(conn->type, "net") != 0) || (strcmp(conn->status, "on") != 0)) {
+ conn = conn->next;
+ continue;
+ }
+
+ _exitcode = startNet2Net(conn->name);
conn = conn->next;
+
+ if (_exitcode > exitcode) {
+ exitcode = _exitcode;
+ }
}
- exit(0);
+ exit(exitcode);
}
void killAllNet2Net() {
+ int exitcode = 0, _exitcode = 0;
+
connection *conn = getConnections();
while(conn) {
- killNet2Net(conn->name);
+ /* Skip all connections that are not of type "net". */
+ if (strcmp(conn->type, "net") != 0) {
+ conn = conn->next;
+ continue;
+ }
+
+ _exitcode = killNet2Net(conn->name);
conn = conn->next;
+
+ if (_exitcode > exitcode) {
+ exitcode = _exitcode;
+ }
}
- exit(0);
+ exit(exitcode);
}
void displayopenvpn(void) {
projects / people / teissler / ipfire-2.x.git / blobdiff