programs/starter/confread.c

   1 /* strongSwan IPsec config file parser
   2  * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
   3  *
   4  * This program is free software; you can redistribute it and/or modify it
   5  * under the terms of the GNU General Public License as published by the
   6  * Free Software Foundation; either version 2 of the License, or (at your
   7  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   8  *
   9  * This program is distributed in the hope that it will be useful, but
  10  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  11  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * for more details.
  13  *
  14  * RCSID $Id: confread.c,v 1.37 2006/04/17 19:35:07 as Exp $
  15  */
  16
  17 #include <stddef.h>
  18 #include <stdlib.h>
  19 #include <string.h>
  20 #include <assert.h>
  21
  22 #include <freeswan.h>
  23
  24 #include "../pluto/constants.h"
  25 #include "../pluto/defs.h"
  26 #include "../pluto/log.h"
  27
  28 #include "keywords.h"
  29 #include "parser.h"
  30 #include "confread.h"
  31 #include "args.h"
  32 #include "interfaces.h"
  33
  34 static const char ike_defaults[] = "3des-sha, 3des-md5";
  35 static const char esp_defaults[] = "3des-sha1, 3des-md5";
  36
  37 static const char firewall_defaults[] = "ipsec _updown iptables";
  38
  39 static void
  40 default_values(starter_config_t *cfg)
  41 {
  42     if (cfg == NULL)
  43         return;
  44
  45     memset(cfg, 0, sizeof(struct starter_config));
  46
  47     /* is there enough space for all seen flags? */
  48     assert(KW_SETUP_LAST - KW_SETUP_FIRST <
  49         sizeof(cfg->setup.seen) * BITS_PER_BYTE);
  50     assert(KW_CONN_LAST  - KW_CONN_FIRST <
  51         sizeof(cfg->conn_default.seen) * BITS_PER_BYTE);
  52     assert(KW_END_LAST - KW_END_FIRST <
  53         sizeof(cfg->conn_default.right.seen) * BITS_PER_BYTE);
  54     assert(KW_CA_LAST - KW_CA_FIRST <
  55         sizeof(cfg->ca_default.seen) * BITS_PER_BYTE);
  56
  57     cfg->setup.seen       = LEMPTY;
  58     cfg->setup.fragicmp   = TRUE;
  59     cfg->setup.hidetos    = TRUE;
  60     cfg->setup.uniqueids  = TRUE;
  61     cfg->setup.interfaces = new_list("%defaultroute");
  62
  63     cfg->conn_default.seen    = LEMPTY;
  64     cfg->conn_default.startup = STARTUP_NO;
  65     cfg->conn_default.state   = STATE_IGNORE;
  66     cfg->conn_default.policy  = POLICY_ENCRYPT | POLICY_TUNNEL | POLICY_RSASIG
  67                               | POLICY_PFS;
  68
  69     cfg->conn_default.ike                   = clone_str(ike_defaults, "ike_defaults");
  70     cfg->conn_default.esp                   = clone_str(esp_defaults, "esp_defaults");
  71     cfg->conn_default.sa_ike_life_seconds   = OAKLEY_ISAKMP_SA_LIFETIME_DEFAULT;
  72     cfg->conn_default.sa_ipsec_life_seconds = PLUTO_SA_LIFE_DURATION_DEFAULT;
  73     cfg->conn_default.sa_rekey_margin       = SA_REPLACEMENT_MARGIN_DEFAULT;
  74     cfg->conn_default.sa_rekey_fuzz         = SA_REPLACEMENT_FUZZ_DEFAULT;
  75     cfg->conn_default.sa_keying_tries       = SA_REPLACEMENT_RETRIES_DEFAULT;
  76     cfg->conn_default.addr_family           = AF_INET;
  77     cfg->conn_default.tunnel_addr_family    = AF_INET;
  78
  79     cfg->conn_default.left.seen  = LEMPTY;
  80     cfg->conn_default.right.seen = LEMPTY;
  81
  82     anyaddr(AF_INET, &cfg->conn_default.left.addr);
  83     anyaddr(AF_INET, &cfg->conn_default.left.nexthop);
  84     anyaddr(AF_INET, &cfg->conn_default.left.srcip);
  85     anyaddr(AF_INET, &cfg->conn_default.right.addr);
  86     anyaddr(AF_INET, &cfg->conn_default.right.nexthop);
  87     anyaddr(AF_INET, &cfg->conn_default.right.srcip);
  88
  89     cfg->ca_default.seen = LEMPTY;
  90 }
  91
  92 #define KW_POLICY_FLAG(sy, sn, fl) \
  93                 if (streq(kw->value, sy)) { conn->policy |= fl; } \
  94                 else if (streq(kw->value, sn)) { conn->policy &= ~fl; } \
  95                 else { plog("# bad policy value: %s=%s", kw->entry->name, kw->value); cfg->err++; }
  96
  97 static void
  98 load_setup(starter_config_t *cfg, config_parsed_t *cfgp)
  99 {
 100     kw_list_t *kw;
 101
 102     DBG(DBG_CONTROL,
 103         DBG_log("Loading config setup")
 104     )
 105
 106     for (kw = cfgp->config_setup; kw; kw = kw->next)
 107     {
 108         bool assigned = FALSE;
 109
 110         kw_token_t token = kw->entry->token;
 111
 112         if (token < KW_SETUP_FIRST || token > KW_SETUP_LAST)
 113         {
 114             plog("# unsupported keyword '%s' in config setup", kw->entry->name);
 115             cfg->err++;
 116             continue;
 117         }
 118
 119         if (!assign_arg(token, KW_SETUP_FIRST, kw, (char *)cfg, &assigned))
 120         {
 121             plog("  bad argument value in config setup");
 122             cfg->err++;
 123             continue;
 124         }
 125     }
 126 }
 127
 128 static void
 129 kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token
 130     , kw_list_t *kw, char *conn_name, starter_config_t *cfg)
 131 {
 132     err_t ugh = NULL;
 133     bool assigned = FALSE;
 134     int has_port_wildcard;        /* set if port is %any */
 135
 136     char *name  = kw->entry->name;
 137     char *value = kw->value;
 138
 139     if (!assign_arg(token, KW_END_FIRST, kw, (char *)end, &assigned))
 140         goto err;
 141
 142     if (token == KW_SENDCERT)
 143     {
 144         if (end->sendcert == CERT_YES_SEND)
 145             end->sendcert = CERT_ALWAYS_SEND;
 146         else if (end->sendcert == CERT_NO_SEND)
 147             end->sendcert = CERT_NEVER_SEND;
 148     }
 149
 150     if (assigned)
 151         return;
 152
 153     switch (token)
 154     {
 155     case KW_HOST:
 156         if (streq(value, "%defaultroute"))
 157         {
 158             if (cfg->defaultroute.defined)
 159             {
 160                 end->addr    = cfg->defaultroute.addr;
 161                 end->nexthop = cfg->defaultroute.nexthop;
 162             }
 163             else
 164             {
 165                 plog("# default route not known: %s=%s", name, value);
 166                 goto err;
 167             }
 168         }
 169         else if (streq(value,"%any"))
 170         {
 171             anyaddr(conn->addr_family, &end->addr);
 172         }
 173         else if (value[0] == '%')
 174         {
 175             if (end->iface)
 176                 pfree(end->iface);
 177             end->iface = clone_str(value+1, "iface");
 178             if (starter_iface_find(end->iface, conn->addr_family, &end->addr,
 179                 &end->nexthop) == -1)
 180             {
 181                 conn->state = STATE_INVALID;
 182             }
 183         }
 184         else
 185         {
 186             ugh = ttoaddr(value, 0, conn->addr_family, &end->addr);
 187             if (ugh != NULL)
 188             {
 189                 plog("# bad addr: %s=%s [%s]", name, value, ugh);
 190                 goto err;
 191             }
 192         }
 193         break;
 194     case KW_NEXTHOP:
 195         if (streq(value, "%defaultroute"))
 196         {
 197             if (cfg->defaultroute.defined)
 198                 end->nexthop = cfg->defaultroute.nexthop;
 199             else
 200             {
 201                 plog("# default route not known: %s=%s", name, value);
 202                 goto err;
 203             }
 204         }
 205         else if (streq(value, "%direct"))
 206             ugh = anyaddr(conn->addr_family, &end->nexthop);
 207         else
 208             ugh = ttoaddr(value, 0, conn->addr_family, &end->nexthop);
 209
 210         if (ugh != NULL)
 211         {
 212             plog("# bad addr: %s=%s [%s]", name, value, ugh);
 213             goto err;
 214         }
 215         break;
 216     case KW_SUBNET:
 217         if ((strlen(value) >= 6 && strncmp(value,"vhost:",6) == 0)
 218         ||  (strlen(value) >= 5 && strncmp(value,"vnet:",5) == 0))
 219         {
 220             end->virt = clone_str(value, "virt");
 221         }
 222         else
 223         {
 224             end->has_client = TRUE;
 225             ugh = ttosubnet(value, 0, conn->tunnel_addr_family, &end->subnet);
 226             if (ugh != NULL)
 227             {
 228                 plog("# bad subnet: %s=%s [%s]", name, value, ugh);
 229                 goto err;
 230             }
 231         }
 232         break;
 233     case KW_SUBNETWITHIN:
 234         end->has_client = TRUE;
 235         end->has_client_wildcard = TRUE;
 236         ugh = ttosubnet(value, 0, conn->tunnel_addr_family, &end->subnet);
 237         break;
 238     case KW_PROTOPORT:
 239         ugh = ttoprotoport(value, 0, &end->protocol, &end->port, &has_port_wildcard);
 240         end->has_port_wildcard = has_port_wildcard;
 241         break;
 242     case KW_SOURCEIP:
 243         if (streq(value, "%modeconfig") || streq(value, "%modecfg"))
 244         {
 245             end->modecfg = TRUE;
 246         }
 247         else
 248         {
 249             ugh = ttoaddr(value, 0, conn->addr_family, &end->srcip);
 250             if (ugh != NULL)
 251             {
 252                 plog("# bad addr: %s=%s [%s]", name, value, ugh);
 253                 goto err;
 254             }
 255             end->has_srcip = TRUE;
 256         }
 257         conn->policy |= POLICY_TUNNEL;
 258         break;
 259     default:
 260         break;
 261     }
 262     return;
 263
 264 err:
 265     plog("  bad argument value in conn '%s'", conn_name);
 266     cfg->err++;
 267 }
 268
 269 /*
 270  * handles left|rightfirewall and left|rightupdown parameters
 271  */
 272 static void
 273 handle_firewall( const char *label, starter_end_t *end, starter_config_t *cfg)
 274 {
 275     if (end->firewall && (end->seen & LELEM(KW_FIREWALL - KW_END_FIRST)))
 276     {
 277         if (end->updown != NULL)
 278         {
 279             plog("# cannot have both %sfirewall and %supdown", label, label);
 280             cfg->err++;
 281         }
 282         else
 283         {
 284             end->updown = clone_str(firewall_defaults, "firewall_defaults");
 285             end->firewall = FALSE;
 286         }
 287     }
 288 }
 289
 290 /*
 291  * parse a conn section
 292  */
 293 static void
 294 load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg)
 295 {
 296     char *conn_name = (conn->name == NULL)? "%default":conn->name;
 297
 298     for ( ; kw; kw = kw->next)
 299     {
 300         bool assigned = FALSE;
 301
 302         kw_token_t token = kw->entry->token;
 303
 304         if (token >= KW_LEFT_FIRST && token <= KW_LEFT_LAST)
 305         {
 306             kw_end(conn, &conn->left, token - KW_LEFT_FIRST + KW_END_FIRST
 307                   , kw, conn_name, cfg);
 308             continue;
 309         }
 310         else if (token >= KW_RIGHT_FIRST && token <= KW_RIGHT_LAST)
 311         {
 312             kw_end(conn, &conn->right, token - KW_RIGHT_FIRST + KW_END_FIRST
 313                   , kw, conn_name, cfg);
 314             continue;
 315         }
 316
 317         if (token == KW_AUTO)
 318         {
 319             token = KW_CONN_SETUP;
 320         }
 321         else if (token == KW_ALSO)
 322         {
 323             if (cfg->parse_also)
 324             {
 325                 also_t *also = alloc_thing(also_t, "also_t");
 326
 327                 also->name = clone_str(kw->value, "also");
 328                 also->next = conn->also;
 329                 conn->also = also;
 330
 331                 DBG(DBG_CONTROL,
 332                     DBG_log("  also=%s", kw->value)
 333                 )
 334             }
 335             continue;
 336         }
 337
 338         if (token < KW_CONN_FIRST || token > KW_CONN_LAST)
 339         {
 340             plog("# unsupported keyword '%s' in conn '%s'"
 341                 , kw->entry->name, conn_name);
 342             cfg->err++;
 343             continue;
 344         }
 345
 346         if (!assign_arg(token, KW_CONN_FIRST, kw, (char *)conn, &assigned))
 347         {
 348             plog("  bad argument value in conn '%s'", conn_name);
 349             cfg->err++;
 350             continue;
 351         }
 352
 353         if (assigned)
 354             continue;
 355
 356         switch (token)
 357         {
 358         case KW_TYPE:
 359             conn->policy &= ~(POLICY_TUNNEL | POLICY_SHUNT_MASK);
 360             if (streq(kw->value, "tunnel"))
 361                 conn->policy |= POLICY_TUNNEL;
 362             else if (streq(kw->value, "passthrough") || streq(kw->value, "pass"))
 363                 conn->policy |= POLICY_SHUNT_PASS;
 364             else if (streq(kw->value, "drop"))
 365                 conn->policy |= POLICY_SHUNT_DROP;
 366             else if (streq(kw->value, "reject"))
 367                 conn->policy |= POLICY_SHUNT_REJECT;
 368             else if (strcmp(kw->value, "transport") != 0)
 369             {
 370                 plog("# bad policy value: %s=%s", kw->entry->name, kw->value);
 371                 cfg->err++;
 372             }
 373            break;
 374         case KW_PFS:
 375             KW_POLICY_FLAG("yes", "no", POLICY_PFS)
 376             break;
 377         case KW_COMPRESS:
 378             KW_POLICY_FLAG("yes", "no", POLICY_COMPRESS)
 379             break;
 380         case KW_AUTH:
 381             KW_POLICY_FLAG("ah", "esp", POLICY_AUTHENTICATE)
 382             break;
 383         case KW_AUTHBY:
 384             conn->policy &= ~(POLICY_RSASIG | POLICY_PSK | POLICY_ENCRYPT);
 385
 386             if (strcmp(kw->value, "never") != 0)
 387             {
 388                 char *value = kw->value;
 389                 char *second = strchr(kw->value, '|');
 390
 391                 if (second != NULL)
 392                     *second = '\0';
 393
 394                 /* also handles the cases secret|rsasig and rsasig|secret */
 395                 for (;;)
 396                 {
 397                     if (streq(value, "rsasig"))
 398                         conn->policy |= POLICY_RSASIG | POLICY_ENCRYPT;
 399                     else if (streq(value, "secret"))
 400                         conn->policy |= POLICY_PSK | POLICY_ENCRYPT;
 401                     else
 402                     {
 403                         plog("# bad policy value: %s=%s", kw->entry->name, kw->value);
 404                         cfg->err++;
 405                         break;
 406                     }
 407                     if (second == NULL)
 408                         break;
 409                     value = second;
 410                     second = NULL; /* traverse the loop no more than twice */
 411                 }
 412             }
 413             break;
 414         case KW_REKEY:
 415             KW_POLICY_FLAG("no", "yes", POLICY_DONT_REKEY)
 416             break;
 417         default:
 418             break;
 419         }
 420     }
 421     handle_firewall("left", &conn->left, cfg);
 422     handle_firewall("right", &conn->right, cfg);
 423 }
 424
 425 /*
 426  * initialize a conn object with the default conn
 427  */
 428 static void
 429 conn_default(char *name, starter_conn_t *conn, starter_conn_t *def)
 430 {
 431     memcpy(conn, def, sizeof(starter_conn_t));
 432     conn->name = clone_str(name, "conn name");
 433
 434     clone_args(KW_CONN_FIRST, KW_CONN_LAST
 435              , (char *)conn, (char *)def);
 436     clone_args(KW_END_FIRST, KW_END_LAST
 437              , (char *)&conn->left, (char *)&def->left);
 438     clone_args(KW_END_FIRST, KW_END_LAST
 439             , (char *)&conn->right, (char *)&def->right);
 440 }
 441
 442 /*
 443  * parse a ca section
 444  */
 445 static void
 446 load_ca(starter_ca_t *ca, kw_list_t *kw, starter_config_t *cfg)
 447 {
 448     char *ca_name = (ca->name == NULL)? "%default":ca->name;
 449
 450     for ( ; kw; kw = kw->next)
 451     {
 452         bool assigned = FALSE;
 453
 454         kw_token_t token = kw->entry->token;
 455
 456         if (token == KW_AUTO)
 457         {
 458             token = KW_CA_SETUP;
 459         }
 460         else if (token == KW_ALSO)
 461         {
 462             if (cfg->parse_also)
 463             {
 464                 also_t *also = alloc_thing(also_t, "also_t");
 465
 466                 also->name = clone_str(kw->value, "also");
 467                 also->next = ca->also;
 468                 ca->also = also;
 469
 470                 DBG(DBG_CONTROL,
 471                     DBG_log("  also=%s", kw->value)
 472                 )
 473             }
 474             continue;
 475         }
 476
 477         if (token < KW_CA_FIRST || token > KW_CA_LAST)
 478         {
 479             plog("# unsupported keyword '%s' in ca '%s'"
 480                      , kw->entry->name, ca_name);
 481             cfg->err++;
 482             continue;
 483         }
 484
 485         if (!assign_arg(token, KW_CA_FIRST, kw, (char *)ca, &assigned))
 486         {
 487             plog("  bad argument value in ca '%s'", ca_name);
 488             cfg->err++;
 489         }
 490     }
 491
 492     /* treat 'route' and 'start' as 'add' */
 493     if (ca->startup != STARTUP_NO)
 494         ca->startup = STARTUP_ADD;
 495 }
 496
 497 /*
 498  * initialize a ca object with the default ca
 499  */
 500 static void
 501 ca_default(char *name, starter_ca_t *ca, starter_ca_t *def)
 502 {
 503     memcpy(ca, def, sizeof(starter_ca_t));
 504     ca->name = clone_str(name, "ca name");
 505
 506     clone_args(KW_CA_FIRST, KW_CA_LAST, (char *)ca, (char *)def);
 507 }
 508
 509 static kw_list_t*
 510 find_also_conn(const char* name, starter_conn_t *conn, starter_config_t *cfg);
 511
 512 static void
 513 load_also_conns(starter_conn_t *conn, also_t *also, starter_config_t *cfg)
 514 {
 515     while (also != NULL)
 516     {
 517         kw_list_t *kw = find_also_conn(also->name, conn, cfg);
 518
 519         if (kw == NULL)
 520         {
 521             plog("  conn '%s' cannot include '%s'", conn->name, also->name);
 522         }
 523         else
 524         {
 525             DBG(DBG_CONTROL,
 526                 DBG_log("conn '%s' includes '%s'", conn->name, also->name)
 527             )
 528             /* only load if no error occurred in the first round */
 529             if (cfg->err == 0)
 530                 load_conn(conn, kw, cfg);
 531         }
 532         also = also->next;
 533     }
 534 }
 535
 536 /*
 537  * find a conn included by also
 538  */
 539 static kw_list_t*
 540 find_also_conn(const char* name, starter_conn_t *conn, starter_config_t *cfg)
 541 {
 542     starter_conn_t *c = cfg->conn_first;
 543
 544     while (c != NULL)
 545     {
 546         if (streq(name, c->name))
 547         {
 548             if (conn->visit == c->visit)
 549             {
 550                 plog("# detected also loop");
 551                 cfg->err++;
 552                 return NULL;
 553             }
 554             c->visit = conn->visit;
 555             load_also_conns(conn, c->also, cfg);
 556             return c->kw;
 557         }
 558         c = c->next;
 559     }
 560
 561     plog("# also '%s' not found", name);
 562     cfg->err++;
 563     return NULL;
 564 }
 565
 566 static kw_list_t*
 567 find_also_ca(const char* name, starter_ca_t *ca, starter_config_t *cfg);
 568
 569 static void
 570 load_also_cas(starter_ca_t *ca, also_t *also, starter_config_t *cfg)
 571 {
 572     while (also != NULL)
 573     {
 574         kw_list_t *kw = find_also_ca(also->name, ca, cfg);
 575
 576         if (kw == NULL)
 577         {
 578             plog("  ca '%s' cannot include '%s'", ca->name, also->name);
 579         }
 580         else
 581         {
 582             DBG(DBG_CONTROL,
 583                 DBG_log("ca '%s' includes '%s'", ca->name, also->name)
 584             )
 585             /* only load if no error occurred in the first round */
 586             if (cfg->err == 0)
 587                 load_ca(ca, kw, cfg);
 588         }
 589         also = also->next;
 590     }
 591 }
 592
 593 /*
 594  * find a ca included by also
 595  */
 596 static kw_list_t*
 597 find_also_ca(const char* name, starter_ca_t *ca, starter_config_t *cfg)
 598 {
 599     starter_ca_t *c = cfg->ca_first;
 600
 601     while (c != NULL)
 602     {
 603         if (streq(name, c->name))
 604         {
 605             if (ca->visit == c->visit)
 606             {
 607                 plog("# detected also loop");
 608                 cfg->err++;
 609                 return NULL;
 610             }
 611             c->visit = ca->visit;
 612             load_also_cas(ca, c->also, cfg);
 613             return c->kw;
 614         }
 615         c = c->next;
 616     }
 617
 618     plog("# also '%s' not found", name);
 619     cfg->err++;
 620     return NULL;
 621 }
 622
 623
 624
 625 /*
 626  * load and parse an IPsec configuration file
 627  */
 628 starter_config_t *
 629 confread_load(const char *file)
 630 {
 631     starter_config_t *cfg = NULL;
 632     config_parsed_t  *cfgp;
 633     section_list_t   *sconn, *sca;
 634     starter_conn_t   *conn;
 635     starter_ca_t     *ca;
 636
 637     u_int visit = 0;
 638
 639     /* load IPSec configuration file  */
 640     cfgp = parser_load_conf(file);
 641     if (!cfgp)
 642         return NULL;
 643
 644     cfg = (starter_config_t *)alloc_thing(starter_config_t, "starter_config_t");
 645
 646     /* set default values */
 647     default_values(cfg);
 648
 649     /* determine default route */
 650     get_defaultroute(&cfg->defaultroute);
 651
 652     /* load config setup section */
 653     load_setup(cfg, cfgp);
 654
 655     /* in the first round parse also statements */
 656     cfg->parse_also = TRUE;
 657
 658      /* find %default ca section */
 659     for (sca = cfgp->ca_first; sca; sca = sca->next)
 660     {
 661         if (streq(sca->name, "%default"))
 662         {
 663             DBG(DBG_CONTROL,
 664                 DBG_log("Loading ca %%default")
 665             )
 666             load_ca(&cfg->ca_default, sca->kw, cfg);
 667         }
 668     }
 669
 670     /* parameters defined in ca %default sections can be overloads */
 671     cfg->ca_default.seen = LEMPTY;
 672
 673     /* load other ca sections */
 674     for (sca = cfgp->ca_first; sca; sca = sca->next)
 675     {
 676         /* skip %default ca section */
 677         if (streq(sca->name, "%default"))
 678             continue;
 679
 680         DBG(DBG_CONTROL,
 681             DBG_log("Loading ca '%s'", sca->name)
 682         )
 683         ca = (starter_ca_t *)alloc_thing(starter_ca_t, "starter_ca_t");
 684
 685         ca_default(sca->name, ca, &cfg->ca_default);
 686         ca->kw =  sca->kw;
 687         ca->next = NULL;
 688
 689         if (cfg->ca_last)
 690             cfg->ca_last->next = ca;
 691         cfg->ca_last = ca;
 692         if (!cfg->ca_first)
 693             cfg->ca_first = ca;
 694
 695         load_ca(ca, ca->kw, cfg);
 696     }
 697
 698     for (ca = cfg->ca_first; ca; ca = ca->next)
 699     {
 700         also_t *also = ca->also;
 701
 702         while (also != NULL)
 703         {
 704             kw_list_t *kw = find_also_ca(also->name, cfg->ca_first, cfg);
 705
 706             load_ca(ca, kw, cfg);
 707             also = also->next;
 708         }
 709
 710         if (ca->startup != STARTUP_NO)
 711             ca->state = STATE_TO_ADD;
 712     }
 713
 714     /* find %default conn sections */
 715     for (sconn = cfgp->conn_first; sconn; sconn = sconn->next)
 716     {
 717         if (streq(sconn->name, "%default"))
 718         {
 719             DBG(DBG_CONTROL,
 720                 DBG_log("Loading conn %%default")
 721             )
 722             load_conn(&cfg->conn_default, sconn->kw, cfg);
 723         }
 724     }
 725
 726     /* parameter defined in conn %default sections can be overloaded */
 727     cfg->conn_default.seen       = LEMPTY;
 728     cfg->conn_default.right.seen = LEMPTY;
 729     cfg->conn_default.left.seen  = LEMPTY;
 730
 731     /* load other conn sections */
 732     for (sconn = cfgp->conn_first; sconn; sconn = sconn->next)
 733     {
 734         /* skip %default conn section */
 735         if (streq(sconn->name, "%default"))
 736             continue;
 737
 738         DBG(DBG_CONTROL,
 739             DBG_log("Loading conn '%s'", sconn->name)
 740         )
 741         conn = (starter_conn_t *)alloc_thing(starter_conn_t, "starter_conn_t");
 742
 743         conn_default(sconn->name, conn, &cfg->conn_default);
 744         conn->kw =  sconn->kw;
 745         conn->next = NULL;
 746
 747         if (cfg->conn_last)
 748             cfg->conn_last->next = conn;
 749         cfg->conn_last = conn;
 750         if (!cfg->conn_first)
 751             cfg->conn_first = conn;
 752
 753         load_conn(conn, conn->kw, cfg);
 754     }
 755
 756     /* in the second round do not parse also statements */
 757     cfg->parse_also = FALSE;
 758
 759     for (ca = cfg->ca_first; ca; ca = ca->next)
 760     {
 761         ca->visit = ++visit;
 762         load_also_cas(ca, ca->also, cfg);
 763
 764         if (ca->startup != STARTUP_NO)
 765             ca->state = STATE_TO_ADD;
 766     }
 767
 768     for (conn = cfg->conn_first; conn; conn = conn->next)
 769     {
 770         conn->visit = ++visit;
 771         load_also_conns(conn, conn->also, cfg);
 772
 773         if (conn->startup != STARTUP_NO)
 774             conn->state = STATE_TO_ADD;
 775     }
 776
 777     parser_free_conf(cfgp);
 778
 779     if (cfg->err)
 780     {
 781         plog("### %d parsing error%s ###", cfg->err, (cfg->err > 1)?"s":"");
 782         confread_free(cfg);
 783         cfg = NULL;
 784     }
 785
 786     return cfg;
 787 }
 788
 789 /*
 790  * free the memory used by also_t objects
 791  */
 792 static void
 793 free_also(also_t *head)
 794 {
 795     while (head != NULL)
 796     {
 797         also_t *also = head;
 798
 799         head = also->next;
 800         pfree(also->name);
 801         pfree(also);
 802     }
 803 }
 804
 805 /*
 806  * free the memory used by a starter_conn_t object
 807  */
 808 static void
 809 confread_free_conn(starter_conn_t *conn)
 810 {
 811     free_args(KW_END_FIRST, KW_END_LAST,  (char *)&conn->left);
 812     free_args(KW_END_FIRST, KW_END_LAST,  (char *)&conn->right);
 813     free_args(KW_CONN_NAME, KW_CONN_LAST, (char *)conn);
 814     free_also(conn->also);
 815 }
 816
 817 /*
 818  * free the memory used by a starter_ca_t object
 819  */
 820 static void
 821 confread_free_ca(starter_ca_t *ca)
 822 {
 823     free_args(KW_CA_NAME, KW_CA_LAST, (char *)ca);
 824     free_also(ca->also);
 825 }
 826
 827 /*
 828  * free the memory used by a starter_config_t object
 829  */
 830 void
 831 confread_free(starter_config_t *cfg)
 832 {
 833     starter_conn_t *conn = cfg->conn_first;
 834     starter_ca_t   *ca   = cfg->ca_first;
 835
 836     free_args(KW_SETUP_FIRST, KW_SETUP_LAST, (char *)cfg);
 837
 838     confread_free_conn(&cfg->conn_default);
 839
 840     while (conn != NULL)
 841     {
 842         starter_conn_t *conn_aux = conn;
 843
 844         conn = conn->next;
 845         confread_free_conn(conn_aux);
 846         pfree(conn_aux);
 847     }
 848
 849     confread_free_ca(&cfg->ca_default);
 850
 851     while (ca != NULL)
 852     {
 853         starter_ca_t *ca_aux = ca;
 854
 855         ca = ca->next;
 856         confread_free_ca(ca_aux);
 857         pfree(ca_aux);
 858     }
 859
 860     pfree(cfg);
 861 }