diff options
Diffstat (limited to 'src/starter')
36 files changed, 3275 insertions, 3213 deletions
diff --git a/src/starter/Makefile.am b/src/starter/Makefile.am index 8a9ba54c9..439a7785a 100644 --- a/src/starter/Makefile.am +++ b/src/starter/Makefile.am @@ -5,9 +5,22 @@ starterstroke.h interfaces.c invokepluto.h confread.h interfaces.h args.c \ keywords.c files.h keywords.h cmp.c starter.c cmp.h exec.c invokecharon.c \ exec.h invokecharon.h lex.yy.c loglite.c klips.c klips.h -INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libfreeswan -I$(top_srcdir)/src/pluto -I$(top_srcdir)/src/whack -I$(top_srcdir)/src/stroke -AM_CFLAGS = -DIPSEC_DIR=\"${ipsecdir}\" -DIPSEC_CONFDIR=\"${confdir}\" -DIPSEC_PIDDIR=\"${piddir}\" -DIPSEC_EAPDIR=\"${eapdir}\" -DDEBUG -starter_LDADD = defs.o $(top_builddir)/src/libfreeswan/libfreeswan.a +INCLUDES = \ +-I${linuxdir} \ +-I$(top_srcdir)/src/libstrongswan \ +-I$(top_srcdir)/src/libfreeswan \ +-I$(top_srcdir)/src/pluto \ +-I$(top_srcdir)/src/whack \ +-I$(top_srcdir)/src/stroke + +AM_CFLAGS = \ +-DIPSEC_DIR=\"${ipsecdir}\" \ +-DIPSEC_CONFDIR=\"${confdir}\" \ +-DIPSEC_PIDDIR=\"${piddir}\" \ +-DIPSEC_EAPDIR=\"${eapdir}\" \ +-DDEBUG + +starter_LDADD = defs.o $(top_builddir)/src/libfreeswan/libfreeswan.a $(top_builddir)/src/libstrongswan/libstrongswan.la EXTRA_DIST = parser.l parser.y keywords.txt ipsec.conf dist_man_MANS = ipsec.conf.5 starter.8 MAINTAINERCLEANFILES = lex.yy.c y.tab.c y.tab.h keywords.c @@ -23,20 +36,20 @@ if USE_CHARON AM_CFLAGS += -DSTART_CHARON endif -lex.yy.c: parser.l parser.y parser.h y.tab.c - $(LEX) --nounput $< +lex.yy.c: $(srcdir)/parser.l $(srcdir)/parser.y $(srcdir)/parser.h + $(LEX) $(srcdir)/parser.l -y.tab.c: parser.y parser.l parser.h - $(YACC) -v -d $< +y.tab.c: $(srcdir)/parser.y $(srcdir)/parser.l $(srcdir)/parser.h + $(YACC) -v -d $(srcdir)/parser.y -y.tab.h: parser.y parser.l parser.h - $(YACC) -v -d $< +y.tab.h: $(srcdir)/parser.y $(srcdir)/parser.l $(srcdir)/parser.h + $(YACC) -v -d $(srcdir)/parser.y -keywords.c: keywords.txt keywords.h - $(GPERF) -C -G -t < $< > $@ +keywords.c: $(srcdir)/keywords.txt $(srcdir)/keywords.h + $(GPERF) -m 10 -C -G -D -t < $(srcdir)/keywords.txt > $@ defs.o: $(PLUTODIR)/defs.c $(PLUTODIR)/defs.h - $(COMPILE) -c -o $@ $< + $(COMPILE) -c -o $@ $(PLUTODIR)/defs.c install-exec-local : test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true diff --git a/src/starter/Makefile.in b/src/starter/Makefile.in index 54fd28604..4e6bffdeb 100644 --- a/src/starter/Makefile.in +++ b/src/starter/Makefile.in @@ -1,4 +1,4 @@ -# Makefile.in generated by automake 1.10.1 from Makefile.am. +# Makefile.in generated by automake 1.10.2 from Makefile.am. # @configure_input@ # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, @@ -56,7 +56,8 @@ am_starter_OBJECTS = y.tab.$(OBJEXT) netkey.$(OBJEXT) \ lex.yy.$(OBJEXT) loglite.$(OBJEXT) klips.$(OBJEXT) starter_OBJECTS = $(am_starter_OBJECTS) starter_DEPENDENCIES = defs.o \ - $(top_builddir)/src/libfreeswan/libfreeswan.a + $(top_builddir)/src/libfreeswan/libfreeswan.a \ + $(top_builddir)/src/libstrongswan/libstrongswan.la DEFAULT_INCLUDES = -I.@am__isrc@ depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles @@ -93,6 +94,7 @@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ +DLLIB = @DLLIB@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ @@ -115,6 +117,9 @@ LDFLAGS = @LDFLAGS@ LEX = @LEX@ LEXLIB = @LEXLIB@ LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@ +LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@ +LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@ +LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@ LIBOBJS = @LIBOBJS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ @@ -126,6 +131,7 @@ MAKEINFO = @MAKEINFO@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ +OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ @@ -139,6 +145,8 @@ PATH_SEPARATOR = @PATH_SEPARATOR@ PERL = @PERL@ PKG_CONFIG = @PKG_CONFIG@ RANLIB = @RANLIB@ +RUBY = @RUBY@ +RUBYINCLUDE = @RUBYINCLUDE@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ @@ -199,6 +207,7 @@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ piddir = @piddir@ plugindir = @plugindir@ +pluto_plugins = @pluto_plugins@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ @@ -210,6 +219,7 @@ srcdir = @srcdir@ strongswan_conf = @strongswan_conf@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ +top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ xml_CFLAGS = @xml_CFLAGS@ @@ -220,11 +230,18 @@ starterstroke.h interfaces.c invokepluto.h confread.h interfaces.h args.c \ keywords.c files.h keywords.h cmp.c starter.c cmp.h exec.c invokecharon.c \ exec.h invokecharon.h lex.yy.c loglite.c klips.c klips.h -INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libfreeswan -I$(top_srcdir)/src/pluto -I$(top_srcdir)/src/whack -I$(top_srcdir)/src/stroke +INCLUDES = \ +-I${linuxdir} \ +-I$(top_srcdir)/src/libstrongswan \ +-I$(top_srcdir)/src/libfreeswan \ +-I$(top_srcdir)/src/pluto \ +-I$(top_srcdir)/src/whack \ +-I$(top_srcdir)/src/stroke + AM_CFLAGS = -DIPSEC_DIR=\"${ipsecdir}\" -DIPSEC_CONFDIR=\"${confdir}\" \ -DIPSEC_PIDDIR=\"${piddir}\" -DIPSEC_EAPDIR=\"${eapdir}\" \ -DDEBUG $(am__append_1) $(am__append_2) -starter_LDADD = defs.o $(top_builddir)/src/libfreeswan/libfreeswan.a +starter_LDADD = defs.o $(top_builddir)/src/libfreeswan/libfreeswan.a $(top_builddir)/src/libstrongswan/libstrongswan.la EXTRA_DIST = parser.l parser.y keywords.txt ipsec.conf dist_man_MANS = ipsec.conf.5 starter.8 MAINTAINERCLEANFILES = lex.yy.c y.tab.c y.tab.h keywords.c @@ -238,8 +255,8 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ - cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \ - && exit 0; \ + ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ + && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ @@ -355,8 +372,8 @@ install-man5: $(man5_MANS) $(man_MANS) esac; \ done; \ for i in $$list; do \ - if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \ - else file=$$i; fi; \ + if test -f $$i; then file=$$i; \ + else file=$(srcdir)/$$i; fi; \ ext=`echo $$i | sed -e 's/^.*\\.//'`; \ case "$$ext" in \ 5*) ;; \ @@ -400,8 +417,8 @@ install-man8: $(man8_MANS) $(man_MANS) esac; \ done; \ for i in $$list; do \ - if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \ - else file=$$i; fi; \ + if test -f $$i; then file=$$i; \ + else file=$(srcdir)/$$i; fi; \ ext=`echo $$i | sed -e 's/^.*\\.//'`; \ case "$$ext" in \ 8*) ;; \ @@ -440,7 +457,7 @@ ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | \ - $(AWK) '{ files[$$0] = 1; nonemtpy = 1; } \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in files) print i; }; }'`; \ mkid -fID $$unique tags: TAGS @@ -620,20 +637,20 @@ uninstall-man: uninstall-man5 uninstall-man8 uninstall-man8 -lex.yy.c: parser.l parser.y parser.h y.tab.c - $(LEX) --nounput $< +lex.yy.c: $(srcdir)/parser.l $(srcdir)/parser.y $(srcdir)/parser.h + $(LEX) $(srcdir)/parser.l -y.tab.c: parser.y parser.l parser.h - $(YACC) -v -d $< +y.tab.c: $(srcdir)/parser.y $(srcdir)/parser.l $(srcdir)/parser.h + $(YACC) -v -d $(srcdir)/parser.y -y.tab.h: parser.y parser.l parser.h - $(YACC) -v -d $< +y.tab.h: $(srcdir)/parser.y $(srcdir)/parser.l $(srcdir)/parser.h + $(YACC) -v -d $(srcdir)/parser.y -keywords.c: keywords.txt keywords.h - $(GPERF) -C -G -t < $< > $@ +keywords.c: $(srcdir)/keywords.txt $(srcdir)/keywords.h + $(GPERF) -m 10 -C -G -D -t < $(srcdir)/keywords.txt > $@ defs.o: $(PLUTODIR)/defs.c $(PLUTODIR)/defs.h - $(COMPILE) -c -o $@ $< + $(COMPILE) -c -o $@ $(PLUTODIR)/defs.c install-exec-local : test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true diff --git a/src/starter/args.c b/src/starter/args.c index c09bea986..f9d1824d8 100644 --- a/src/starter/args.c +++ b/src/starter/args.c @@ -11,8 +11,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: args.c 4612 2008-11-11 06:37:37Z andreas $ */ #include <stddef.h> @@ -33,276 +31,283 @@ /* argument types */ typedef enum { - ARG_NONE, - ARG_ENUM, - ARG_UINT, - ARG_TIME, - ARG_ULNG, - ARG_PCNT, - ARG_STR, - ARG_LST, - ARG_MISC + ARG_NONE, + ARG_ENUM, + ARG_UINT, + ARG_TIME, + ARG_ULNG, + ARG_PCNT, + ARG_STR, + ARG_LST, + ARG_MISC } arg_t; /* various keyword lists */ static const char *LST_bool[] = { - "no", - "yes", - NULL + "no", + "yes", + NULL }; static const char *LST_sendcert[] = { - "always", - "ifasked", - "never", - "yes", - "no", - NULL + "always", + "ifasked", + "never", + "yes", + "no", + NULL }; static const char *LST_unique[] = { - "no", - "yes", - "replace", - "keep", - NULL + "no", + "yes", + "replace", + "keep", + NULL }; static const char *LST_strict[] = { - "no", - "yes", - "ifuri", - NULL + "no", + "yes", + "ifuri", + NULL }; static const char *LST_dpd_action[] = { - "none", - "clear", - "hold", - "restart", - NULL + "none", + "clear", + "hold", + "restart", + NULL }; static const char *LST_startup[] = { - "ignore", - "add", - "route", - "start", - NULL + "ignore", + "add", + "route", + "start", + NULL }; static const char *LST_packetdefault[] = { - "drop", - "reject", - "pass", - NULL + "drop", + "reject", + "pass", + NULL }; static const char *LST_keyexchange[] = { - "ike", - "ikev1", - "ikev2", - NULL + "ike", + "ikev1", + "ikev2", + NULL }; static const char *LST_pfsgroup[] = { - "modp1024", - "modp1536", - "modp2048", - "modp3072", - "modp4096", - "modp6144", - "modp8192", - NULL + "modp1024", + "modp1536", + "modp2048", + "modp3072", + "modp4096", + "modp6144", + "modp8192", + NULL }; static const char *LST_plutodebug[] = { - "none", - "all", - "raw", - "crypt", - "parsing", - "emitting", - "control", - "lifecycle", - "klips", - "dns", - "natt", - "oppo", - "controlmore", - "private", - NULL + "none", + "all", + "raw", + "crypt", + "parsing", + "emitting", + "control", + "lifecycle", + "klips", + "dns", + "natt", + "oppo", + "controlmore", + "private", + NULL }; static const char *LST_klipsdebug[] = { - "tunnel", - "tunnel-xmit", - "pfkey", - "xform", - "eroute", - "spi", - "radij", - "esp", - "ah", - "ipcomp", - "verbose", - "all", - "none", - NULL + "tunnel", + "tunnel-xmit", + "pfkey", + "xform", + "eroute", + "spi", + "radij", + "esp", + "ah", + "ipcomp", + "verbose", + "all", + "none", + NULL }; typedef struct { - arg_t type; - size_t offset; - const char **list; + arg_t type; + size_t offset; + const char **list; } token_info_t; static const token_info_t token_info[] = { - /* config setup keywords */ - { ARG_LST, offsetof(starter_config_t, setup.interfaces), NULL }, - { ARG_STR, offsetof(starter_config_t, setup.dumpdir), NULL }, - { ARG_ENUM, offsetof(starter_config_t, setup.charonstart), LST_bool }, - { ARG_ENUM, offsetof(starter_config_t, setup.plutostart), LST_bool }, - - /* pluto/charon keywords */ - { ARG_LST, offsetof(starter_config_t, setup.plutodebug), LST_plutodebug }, - { ARG_STR, offsetof(starter_config_t, setup.charondebug), NULL }, - { ARG_STR, offsetof(starter_config_t, setup.prepluto), NULL }, - { ARG_STR, offsetof(starter_config_t, setup.postpluto), NULL }, - { ARG_STR, offsetof(starter_config_t, setup.plutostderrlog), NULL }, - { ARG_ENUM, offsetof(starter_config_t, setup.uniqueids), LST_unique }, - { ARG_UINT, offsetof(starter_config_t, setup.overridemtu), NULL }, - { ARG_TIME, offsetof(starter_config_t, setup.crlcheckinterval), NULL }, - { ARG_ENUM, offsetof(starter_config_t, setup.cachecrls), LST_bool }, - { ARG_ENUM, offsetof(starter_config_t, setup.strictcrlpolicy), LST_strict }, - { ARG_ENUM, offsetof(starter_config_t, setup.nocrsend), LST_bool }, - { ARG_ENUM, offsetof(starter_config_t, setup.nat_traversal), LST_bool }, - { ARG_TIME, offsetof(starter_config_t, setup.keep_alive), NULL }, - { ARG_ENUM, offsetof(starter_config_t, setup.force_keepalive), LST_bool }, - { ARG_STR, offsetof(starter_config_t, setup.virtual_private), NULL }, - { ARG_STR, offsetof(starter_config_t, setup.pkcs11module), NULL }, - { ARG_STR, offsetof(starter_config_t, setup.pkcs11initargs), NULL }, - { ARG_ENUM, offsetof(starter_config_t, setup.pkcs11keepstate), LST_bool }, - { ARG_ENUM, offsetof(starter_config_t, setup.pkcs11proxy), LST_bool }, - - /* KLIPS keywords */ - { ARG_LST, offsetof(starter_config_t, setup.klipsdebug), LST_klipsdebug }, - { ARG_ENUM, offsetof(starter_config_t, setup.fragicmp), LST_bool }, - { ARG_STR, offsetof(starter_config_t, setup.packetdefault), LST_packetdefault }, - { ARG_ENUM, offsetof(starter_config_t, setup.hidetos), LST_bool }, - - /* conn section keywords */ - { ARG_STR, offsetof(starter_conn_t, name), NULL }, - { ARG_ENUM, offsetof(starter_conn_t, startup), LST_startup }, - { ARG_ENUM, offsetof(starter_conn_t, keyexchange), LST_keyexchange }, - { ARG_MISC, 0, NULL /* KW_TYPE */ }, - { ARG_MISC, 0, NULL /* KW_PFS */ }, - { ARG_MISC, 0, NULL /* KW_COMPRESS */ }, - { ARG_ENUM, offsetof(starter_conn_t, install_policy), LST_bool }, - { ARG_MISC, 0, NULL /* KW_AUTH */ }, - { ARG_MISC, 0, NULL /* KW_AUTHBY */ }, - { ARG_MISC, 0, NULL /* KW_EAP */ }, - { ARG_STR, offsetof(starter_conn_t, eap_identity), NULL }, - { ARG_MISC, 0, NULL /* KW_MOBIKE */ }, - { ARG_MISC, 0, NULL /* KW_FORCEENCAPS */ }, - { ARG_TIME, offsetof(starter_conn_t, sa_ike_life_seconds), NULL }, - { ARG_TIME, offsetof(starter_conn_t, sa_ipsec_life_seconds), NULL }, - { ARG_TIME, offsetof(starter_conn_t, sa_rekey_margin), NULL }, - { ARG_MISC, 0, NULL /* KW_KEYINGTRIES */ }, - { ARG_PCNT, offsetof(starter_conn_t, sa_rekey_fuzz), NULL }, - { ARG_MISC, 0, NULL /* KW_REKEY */ }, - { ARG_MISC, 0, NULL /* KW_REAUTH */ }, - { ARG_STR, offsetof(starter_conn_t, ike), NULL }, - { ARG_STR, offsetof(starter_conn_t, esp), NULL }, - { ARG_STR, offsetof(starter_conn_t, pfsgroup), LST_pfsgroup }, - { ARG_TIME, offsetof(starter_conn_t, dpd_delay), NULL }, - { ARG_TIME, offsetof(starter_conn_t, dpd_timeout), NULL }, - { ARG_ENUM, offsetof(starter_conn_t, dpd_action), LST_dpd_action }, - { ARG_MISC, 0, NULL /* KW_MODECONFIG */ }, - { ARG_MISC, 0, NULL /* KW_XAUTH */ }, - { ARG_ENUM, offsetof(starter_conn_t, me_mediation), LST_bool }, - { ARG_STR, offsetof(starter_conn_t, me_mediated_by), NULL }, - { ARG_STR, offsetof(starter_conn_t, me_peerid), NULL }, - - /* ca section keywords */ - { ARG_STR, offsetof(starter_ca_t, name), NULL }, - { ARG_ENUM, offsetof(starter_ca_t, startup), LST_startup }, - { ARG_STR, offsetof(starter_ca_t, cacert), NULL }, - { ARG_STR, offsetof(starter_ca_t, ldaphost), NULL }, - { ARG_STR, offsetof(starter_ca_t, ldapbase), NULL }, - { ARG_STR, offsetof(starter_ca_t, crluri), NULL }, - { ARG_STR, offsetof(starter_ca_t, crluri2), NULL }, - { ARG_STR, offsetof(starter_ca_t, ocspuri), NULL }, - { ARG_STR, offsetof(starter_ca_t, ocspuri2), NULL }, - { ARG_STR, offsetof(starter_ca_t, certuribase), NULL }, - - /* end keywords */ - { ARG_MISC, 0, NULL /* KW_HOST */ }, - { ARG_MISC, 0, NULL /* KW_NEXTHOP */ }, - { ARG_STR, offsetof(starter_end_t, subnet), NULL }, - { ARG_MISC, 0, NULL /* KW_SUBNETWITHIN */ }, - { ARG_MISC, 0, NULL /* KW_PROTOPORT */ }, - { ARG_STR, offsetof(starter_end_t, srcip), NULL }, - { ARG_MISC, 0, NULL /* KW_NATIP */ }, - { ARG_ENUM, offsetof(starter_end_t, firewall), LST_bool }, - { ARG_ENUM, offsetof(starter_end_t, hostaccess), LST_bool }, - { ARG_ENUM, offsetof(starter_end_t, allow_any), LST_bool }, - { ARG_STR, offsetof(starter_end_t, updown), NULL }, - { ARG_STR, offsetof(starter_end_t, id), NULL }, - { ARG_STR, offsetof(starter_end_t, rsakey), NULL }, - { ARG_STR, offsetof(starter_end_t, cert), NULL }, - { ARG_ENUM, offsetof(starter_end_t, sendcert), LST_sendcert }, - { ARG_STR, offsetof(starter_end_t, ca), NULL }, - { ARG_STR, offsetof(starter_end_t, groups), NULL }, - { ARG_STR, offsetof(starter_end_t, iface), NULL } + /* config setup keywords */ + { ARG_LST, offsetof(starter_config_t, setup.interfaces), NULL }, + { ARG_STR, offsetof(starter_config_t, setup.dumpdir), NULL }, + { ARG_ENUM, offsetof(starter_config_t, setup.charonstart), LST_bool }, + { ARG_ENUM, offsetof(starter_config_t, setup.plutostart), LST_bool }, + + /* pluto/charon keywords */ + { ARG_LST, offsetof(starter_config_t, setup.plutodebug), LST_plutodebug }, + { ARG_STR, offsetof(starter_config_t, setup.charondebug), NULL }, + { ARG_STR, offsetof(starter_config_t, setup.prepluto), NULL }, + { ARG_STR, offsetof(starter_config_t, setup.postpluto), NULL }, + { ARG_STR, offsetof(starter_config_t, setup.plutostderrlog), NULL }, + { ARG_ENUM, offsetof(starter_config_t, setup.uniqueids), LST_unique }, + { ARG_UINT, offsetof(starter_config_t, setup.overridemtu), NULL }, + { ARG_TIME, offsetof(starter_config_t, setup.crlcheckinterval), NULL }, + { ARG_ENUM, offsetof(starter_config_t, setup.cachecrls), LST_bool }, + { ARG_ENUM, offsetof(starter_config_t, setup.strictcrlpolicy), LST_strict }, + { ARG_ENUM, offsetof(starter_config_t, setup.nocrsend), LST_bool }, + { ARG_ENUM, offsetof(starter_config_t, setup.nat_traversal), LST_bool }, + { ARG_TIME, offsetof(starter_config_t, setup.keep_alive), NULL }, + { ARG_ENUM, offsetof(starter_config_t, setup.force_keepalive), LST_bool }, + { ARG_STR, offsetof(starter_config_t, setup.virtual_private), NULL }, + { ARG_STR, offsetof(starter_config_t, setup.pkcs11module), NULL }, + { ARG_STR, offsetof(starter_config_t, setup.pkcs11initargs), NULL }, + { ARG_ENUM, offsetof(starter_config_t, setup.pkcs11keepstate), LST_bool }, + { ARG_ENUM, offsetof(starter_config_t, setup.pkcs11proxy), LST_bool }, + + /* KLIPS keywords */ + { ARG_LST, offsetof(starter_config_t, setup.klipsdebug), LST_klipsdebug }, + { ARG_ENUM, offsetof(starter_config_t, setup.fragicmp), LST_bool }, + { ARG_STR, offsetof(starter_config_t, setup.packetdefault), LST_packetdefault }, + { ARG_ENUM, offsetof(starter_config_t, setup.hidetos), LST_bool }, + + /* conn section keywords */ + { ARG_STR, offsetof(starter_conn_t, name), NULL }, + { ARG_ENUM, offsetof(starter_conn_t, startup), LST_startup }, + { ARG_ENUM, offsetof(starter_conn_t, keyexchange), LST_keyexchange }, + { ARG_MISC, 0, NULL /* KW_TYPE */ }, + { ARG_MISC, 0, NULL /* KW_PFS */ }, + { ARG_MISC, 0, NULL /* KW_COMPRESS */ }, + { ARG_ENUM, offsetof(starter_conn_t, install_policy), LST_bool }, + { ARG_MISC, 0, NULL /* KW_AUTH */ }, + { ARG_MISC, 0, NULL /* KW_AUTHBY */ }, + { ARG_MISC, 0, NULL /* KW_EAP */ }, + { ARG_STR, offsetof(starter_conn_t, eap_identity), NULL }, + { ARG_MISC, 0, NULL /* KW_MOBIKE */ }, + { ARG_MISC, 0, NULL /* KW_FORCEENCAPS */ }, + { ARG_TIME, offsetof(starter_conn_t, sa_ike_life_seconds), NULL }, + { ARG_TIME, offsetof(starter_conn_t, sa_ipsec_life_seconds), NULL }, + { ARG_TIME, offsetof(starter_conn_t, sa_rekey_margin), NULL }, + { ARG_MISC, 0, NULL /* KW_KEYINGTRIES */ }, + { ARG_PCNT, offsetof(starter_conn_t, sa_rekey_fuzz), NULL }, + { ARG_MISC, 0, NULL /* KW_REKEY */ }, + { ARG_MISC, 0, NULL /* KW_REAUTH */ }, + { ARG_STR, offsetof(starter_conn_t, ike), NULL }, + { ARG_STR, offsetof(starter_conn_t, esp), NULL }, + { ARG_STR, offsetof(starter_conn_t, pfsgroup), LST_pfsgroup }, + { ARG_TIME, offsetof(starter_conn_t, dpd_delay), NULL }, + { ARG_TIME, offsetof(starter_conn_t, dpd_timeout), NULL }, + { ARG_ENUM, offsetof(starter_conn_t, dpd_action), LST_dpd_action }, + { ARG_MISC, 0, NULL /* KW_MODECONFIG */ }, + { ARG_MISC, 0, NULL /* KW_XAUTH */ }, + { ARG_ENUM, offsetof(starter_conn_t, me_mediation), LST_bool }, + { ARG_STR, offsetof(starter_conn_t, me_mediated_by), NULL }, + { ARG_STR, offsetof(starter_conn_t, me_peerid), NULL }, + + /* ca section keywords */ + { ARG_STR, offsetof(starter_ca_t, name), NULL }, + { ARG_ENUM, offsetof(starter_ca_t, startup), LST_startup }, + { ARG_STR, offsetof(starter_ca_t, cacert), NULL }, + { ARG_STR, offsetof(starter_ca_t, ldaphost), NULL }, + { ARG_STR, offsetof(starter_ca_t, ldapbase), NULL }, + { ARG_STR, offsetof(starter_ca_t, crluri), NULL }, + { ARG_STR, offsetof(starter_ca_t, crluri2), NULL }, + { ARG_STR, offsetof(starter_ca_t, ocspuri), NULL }, + { ARG_STR, offsetof(starter_ca_t, ocspuri2), NULL }, + { ARG_STR, offsetof(starter_ca_t, certuribase), NULL }, + + /* end keywords */ + { ARG_MISC, 0, NULL /* KW_HOST */ }, + { ARG_MISC, 0, NULL /* KW_NEXTHOP */ }, + { ARG_STR, offsetof(starter_end_t, subnet), NULL }, + { ARG_MISC, 0, NULL /* KW_SUBNETWITHIN */ }, + { ARG_MISC, 0, NULL /* KW_PROTOPORT */ }, + { ARG_STR, offsetof(starter_end_t, srcip), NULL }, + { ARG_MISC, 0, NULL /* KW_NATIP */ }, + { ARG_ENUM, offsetof(starter_end_t, firewall), LST_bool }, + { ARG_ENUM, offsetof(starter_end_t, hostaccess), LST_bool }, + { ARG_ENUM, offsetof(starter_end_t, allow_any), LST_bool }, + { ARG_STR, offsetof(starter_end_t, updown), NULL }, + { ARG_STR, offsetof(starter_end_t, auth), NULL }, + { ARG_STR, offsetof(starter_end_t, auth2), NULL }, + { ARG_STR, offsetof(starter_end_t, id), NULL }, + { ARG_STR, offsetof(starter_end_t, id2), NULL }, + { ARG_STR, offsetof(starter_end_t, rsakey), NULL }, + { ARG_STR, offsetof(starter_end_t, cert), NULL }, + { ARG_STR, offsetof(starter_end_t, cert2), NULL }, + { ARG_ENUM, offsetof(starter_end_t, sendcert), LST_sendcert }, + { ARG_STR, offsetof(starter_end_t, ca), NULL }, + { ARG_STR, offsetof(starter_end_t, ca2), NULL }, + { ARG_STR, offsetof(starter_end_t, groups), NULL }, + { ARG_STR, offsetof(starter_end_t, iface), NULL } }; static void free_list(char **list) { - char **s; + char **s; - for (s = list; *s; s++) - pfree(*s); - pfree(list); + for (s = list; *s; s++) + { + free(*s); + } + free(list); } char ** new_list(char *value) { - char *val, *b, *e, *end, **ret; - int count; - - val = value ? clone_str(value, "list value") : NULL; - if (!val) - return NULL; - end = val + strlen(val); - for (b = val, count = 0; b < end;) - { - for (e = b; ((*e != ' ') && (*e != '\0')); e++); - *e = '\0'; - if (e != b) - count++; - b = e + 1; - } - if (count == 0) - { - pfree(val); - return NULL; - } - ret = (char **)alloc_bytes((count+1) * sizeof(char *), "list"); - - for (b = val, count = 0; b < end; ) - { - for (e = b; (*e != '\0'); e++); - if (e != b) - ret[count++] = clone_str(b, "list value"); - b = e + 1; - } - ret[count] = NULL; - pfree(val); - return ret; + char *val, *b, *e, *end, **ret; + int count; + + val = value ? clone_str(value) : NULL; + if (!val) + return NULL; + end = val + strlen(val); + for (b = val, count = 0; b < end;) + { + for (e = b; ((*e != ' ') && (*e != '\0')); e++); + *e = '\0'; + if (e != b) + count++; + b = e + 1; + } + if (count == 0) + { + free(val); + return NULL; + } + ret = (char **)malloc((count+1) * sizeof(char *)); + + for (b = val, count = 0; b < end; ) + { + for (e = b; (*e != '\0'); e++); + if (e != b) + ret[count++] = clone_str(b); + b = e + 1; + } + ret[count] = NULL; + free(val); + return ret; } @@ -311,191 +316,199 @@ new_list(char *value) */ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base - , bool *assigned) + , bool *assigned) { - char *p = base + token_info[token].offset; - const char **list = token_info[token].list; - - int index = -1; /* used for enumeration arguments */ - - lset_t *seen = (lset_t *)base; /* seen flags are at the top of the struct */ - lset_t f = LELEM(token - first); /* compute flag position of argument */ - - *assigned = FALSE; + char *p = base + token_info[token].offset; + const char **list = token_info[token].list; - DBG(DBG_CONTROLMORE, - DBG_log(" %s=%s", kw->entry->name, kw->value) - ) + int index = -1; /* used for enumeration arguments */ - if (*seen & f) - { - plog("# duplicate '%s' option", kw->entry->name); - return FALSE; - } + lset_t *seen = (lset_t *)base; /* seen flags are at the top of the struct */ + lset_t f = LELEM(token - first); /* compute flag position of argument */ - /* set flag that this argument has been seen */ - *seen |= f; + *assigned = FALSE; - /* is there a keyword list? */ - if (list != NULL && token_info[token].type != ARG_LST) - { - bool match = FALSE; + DBG(DBG_CONTROLMORE, + DBG_log(" %s=%s", kw->entry->name, kw->value) + ) - while (*list != NULL && !match) - { - index++; - match = streq(kw->value, *list++); - } - if (!match) - { - plog("# bad value: %s=%s", kw->entry->name, kw->value); - return FALSE; - } - } - - switch (token_info[token].type) - { - case ARG_NONE: - plog("# option '%s' not supported yet", kw->entry->name); - return FALSE; - case ARG_ENUM: + if (*seen & f) { - int *i = (int *)p; - - if (index < 0) - { - plog("# bad enumeration value: %s=%s (%d)" - , kw->entry->name, kw->value, index); + plog("# duplicate '%s' option", kw->entry->name); return FALSE; - } - *i = index; } - break; - - case ARG_UINT: - { - char *endptr; - u_int *u = (u_int *)p; - *u = strtoul(kw->value, &endptr, 10); + /* set flag that this argument has been seen */ + *seen |= f; - if (*endptr != '\0') - { - plog("# bad integer value: %s=%s", kw->entry->name, kw->value); - return FALSE; - } - } - break; - case ARG_ULNG: - case ARG_PCNT: + /* is there a keyword list? */ + if (list != NULL && token_info[token].type != ARG_LST) { - char *endptr; - unsigned long *l = (unsigned long *)p; + bool match = FALSE; - *l = strtoul(kw->value, &endptr, 10); - - if (token_info[token].type == ARG_ULNG) - { - if (*endptr != '\0') + while (*list != NULL && !match) { - plog("# bad integer value: %s=%s", kw->entry->name, kw->value); - return FALSE; + index++; + match = streq(kw->value, *list++); } - } - else - { - if ((*endptr != '%') || (endptr[1] != '\0') || endptr == kw->value) + if (!match) { - plog("# bad percent value: %s=%s", kw->entry->name, kw->value); - return FALSE; + plog("# bad value: %s=%s", kw->entry->name, kw->value); + return FALSE; } - } - } - break; - case ARG_TIME: - { - char *endptr; - time_t *t = (time_t *)p; - *t = strtoul(kw->value, &endptr, 10); - - /* time in seconds? */ - if (*endptr == '\0' || (*endptr == 's' && endptr[1] == '\0')) + switch (token_info[token].type) + { + case ARG_NONE: + plog("# option '%s' not supported yet", kw->entry->name); + return FALSE; + case ARG_ENUM: + { + if (index < 0) + { + plog("# bad enumeration value: %s=%s (%d)" + , kw->entry->name, kw->value, index); + return FALSE; + } + + if (token_info[token].list == LST_bool) + { + bool *b = (bool *)p; + *b = (index > 0); + } + else + { + int *i = (int *)p; + *i = index; + } + } break; - if (endptr[1] == '\0') - { - if (*endptr == 'm') /* time in minutes? */ + case ARG_UINT: { - *t *= 60; - break; + char *endptr; + u_int *u = (u_int *)p; + + *u = strtoul(kw->value, &endptr, 10); + + if (*endptr != '\0') + { + plog("# bad integer value: %s=%s", kw->entry->name, kw->value); + return FALSE; + } } - if (*endptr == 'h') /* time in hours? */ + break; + case ARG_ULNG: + case ARG_PCNT: { - *t *= 3600; - break; + char *endptr; + unsigned long *l = (unsigned long *)p; + + *l = strtoul(kw->value, &endptr, 10); + + if (token_info[token].type == ARG_ULNG) + { + if (*endptr != '\0') + { + plog("# bad integer value: %s=%s", kw->entry->name, kw->value); + return FALSE; + } + } + else + { + if ((*endptr != '%') || (endptr[1] != '\0') || endptr == kw->value) + { + plog("# bad percent value: %s=%s", kw->entry->name, kw->value); + return FALSE; + } + } + } - if (*endptr == 'd') /* time in days? */ + break; + case ARG_TIME: { - *t *= 3600*24; - break; + char *endptr; + time_t *t = (time_t *)p; + + *t = strtoul(kw->value, &endptr, 10); + + /* time in seconds? */ + if (*endptr == '\0' || (*endptr == 's' && endptr[1] == '\0')) + break; + + if (endptr[1] == '\0') + { + if (*endptr == 'm') /* time in minutes? */ + { + *t *= 60; + break; + } + if (*endptr == 'h') /* time in hours? */ + { + *t *= 3600; + break; + } + if (*endptr == 'd') /* time in days? */ + { + *t *= 3600*24; + break; + } + } + plog("# bad duration value: %s=%s", kw->entry->name, kw->value); + return FALSE; } - } - plog("# bad duration value: %s=%s", kw->entry->name, kw->value); - return FALSE; - } - case ARG_STR: - { - char **cp = (char **)p; - - /* free any existing string */ - pfreeany(*cp); - - /* assign the new string */ - *cp = clone_str(kw->value, "str_value"); - } - break; - case ARG_LST: - { - char ***listp = (char ***)p; - - /* free any existing list */ - if (*listp != NULL) - free_list(*listp); - - /* create a new list and assign values */ - *listp = new_list(kw->value); + case ARG_STR: + { + char **cp = (char **)p; - /* is there a keyword list? */ - if (list != NULL) - { - char ** lst; + /* free any existing string */ + free(*cp); - for (lst = *listp; lst && *lst; lst++) + /* assign the new string */ + *cp = clone_str(kw->value); + } + break; + case ARG_LST: { - bool match = FALSE; - - list = token_info[token].list; - - while (*list != NULL && !match) - { - match = streq(*lst, *list++); - } - if (!match) - { - plog("# bad value: %s=%s", kw->entry->name, *lst); - return FALSE; - } + char ***listp = (char ***)p; + + /* free any existing list */ + if (*listp != NULL) + free_list(*listp); + + /* create a new list and assign values */ + *listp = new_list(kw->value); + + /* is there a keyword list? */ + if (list != NULL) + { + char ** lst; + + for (lst = *listp; lst && *lst; lst++) + { + bool match = FALSE; + + list = token_info[token].list; + + while (*list != NULL && !match) + { + match = streq(*lst, *list++); + } + if (!match) + { + plog("# bad value: %s=%s", kw->entry->name, *lst); + return FALSE; + } + } + } } - } + default: + return TRUE; } - default: - return TRUE; - } - *assigned = TRUE; - return TRUE; + *assigned = TRUE; + return TRUE; } /* @@ -504,37 +517,37 @@ assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base void free_args(kw_token_t first, kw_token_t last, char *base) { - kw_token_t token; - - for (token = first; token <= last; token++) - { - char *p = base + token_info[token].offset; + kw_token_t token; - switch (token_info[token].type) + for (token = first; token <= last; token++) { - case ARG_STR: - { - char **cp = (char **)p; + char *p = base + token_info[token].offset; - pfreeany(*cp); - *cp = NULL; - } - break; - case ARG_LST: - { - char ***listp = (char ***)p; - - if (*listp != NULL) + switch (token_info[token].type) { - free_list(*listp); - *listp = NULL; - } - } - break; - default: - break; + case ARG_STR: + { + char **cp = (char **)p; + + free(*cp); + *cp = NULL; + } + break; + case ARG_LST: + { + char ***listp = (char ***)p; + + if (*listp != NULL) + { + free_list(*listp); + *listp = NULL; + } + } + break; + default: + break; + } } - } } /* @@ -543,38 +556,38 @@ free_args(kw_token_t first, kw_token_t last, char *base) void clone_args(kw_token_t first, kw_token_t last, char *base1, char *base2) { - kw_token_t token; + kw_token_t token; - for (token = first; token <= last; token++) - { - if (token_info[token].type == ARG_STR) + for (token = first; token <= last; token++) { - char **cp1 = (char **)(base1 + token_info[token].offset); - char **cp2 = (char **)(base2 + token_info[token].offset); + if (token_info[token].type == ARG_STR) + { + char **cp1 = (char **)(base1 + token_info[token].offset); + char **cp2 = (char **)(base2 + token_info[token].offset); - *cp1 = clone_str(*cp2, "cloned str"); + *cp1 = clone_str(*cp2); + } } - } } static bool cmp_list(char **list1, char **list2) { - if ((list1 == NULL) && (list2 == NULL)) - return TRUE; - if ((list1 == NULL) || (list2 == NULL)) - return FALSE; + if ((list1 == NULL) && (list2 == NULL)) + return TRUE; + if ((list1 == NULL) || (list2 == NULL)) + return FALSE; - for ( ; *list1 && *list2; list1++, list2++) - { - if (strcmp(*list1,*list2) != 0) - return FALSE; - } + for ( ; *list1 && *list2; list1++, list2++) + { + if (strcmp(*list1,*list2) != 0) + return FALSE; + } - if ((*list1 != NULL) || (*list2 != NULL)) - return FALSE; + if ((*list1 != NULL) || (*list2 != NULL)) + return FALSE; - return TRUE; + return TRUE; } /* @@ -583,75 +596,75 @@ cmp_list(char **list1, char **list2) bool cmp_args(kw_token_t first, kw_token_t last, char *base1, char *base2) { - kw_token_t token; - - for (token = first; token <= last; token++) - { - char *p1 = base1 + token_info[token].offset; - char *p2 = base2 + token_info[token].offset; + kw_token_t token; - switch (token_info[token].type) + for (token = first; token <= last; token++) { - case ARG_ENUM: - { - int *i1 = (int *)p1; - int *i2 = (int *)p2; - - if (*i1 != *i2) - return FALSE; - } - break; - case ARG_UINT: - { - u_int *u1 = (u_int *)p1; - u_int *u2 = (u_int *)p2; - - if (*u1 != *u2) - return FALSE; - } - break; - case ARG_ULNG: - case ARG_PCNT: - { - unsigned long *l1 = (unsigned long *)p1; - unsigned long *l2 = (unsigned long *)p2; - - if (*l1 != *l2) - return FALSE; - } - break; - case ARG_TIME: - { - time_t *t1 = (time_t *)p1; - time_t *t2 = (time_t *)p2; - - if (*t1 != *t2) - return FALSE; - } - break; - case ARG_STR: - { - char **cp1 = (char **)p1; - char **cp2 = (char **)p2; - - if (*cp1 == NULL && *cp2 == NULL) - break; - if (*cp1 == NULL || *cp2 == NULL || strcmp(*cp1, *cp2) != 0) - return FALSE; - } - break; - case ARG_LST: - { - char ***listp1 = (char ***)p1; - char ***listp2 = (char ***)p2; - - if (!cmp_list(*listp1, *listp2)) - return FALSE; - } - break; - default: - break; + char *p1 = base1 + token_info[token].offset; + char *p2 = base2 + token_info[token].offset; + + switch (token_info[token].type) + { + case ARG_ENUM: + { + int *i1 = (int *)p1; + int *i2 = (int *)p2; + + if (*i1 != *i2) + return FALSE; + } + break; + case ARG_UINT: + { + u_int *u1 = (u_int *)p1; + u_int *u2 = (u_int *)p2; + + if (*u1 != *u2) + return FALSE; + } + break; + case ARG_ULNG: + case ARG_PCNT: + { + unsigned long *l1 = (unsigned long *)p1; + unsigned long *l2 = (unsigned long *)p2; + + if (*l1 != *l2) + return FALSE; + } + break; + case ARG_TIME: + { + time_t *t1 = (time_t *)p1; + time_t *t2 = (time_t *)p2; + + if (*t1 != *t2) + return FALSE; + } + break; + case ARG_STR: + { + char **cp1 = (char **)p1; + char **cp2 = (char **)p2; + + if (*cp1 == NULL && *cp2 == NULL) + break; + if (*cp1 == NULL || *cp2 == NULL || strcmp(*cp1, *cp2) != 0) + return FALSE; + } + break; + case ARG_LST: + { + char ***listp1 = (char ***)p1; + char ***listp2 = (char ***)p2; + + if (!cmp_list(*listp1, *listp2)) + return FALSE; + } + break; + default: + break; + } } - } - return TRUE; + return TRUE; } diff --git a/src/starter/args.h b/src/starter/args.h index 7bd55bb05..b003784c8 100644 --- a/src/starter/args.h +++ b/src/starter/args.h @@ -11,8 +11,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: args.h 3267 2007-10-08 19:57:54Z andreas $ */ #ifndef _ARGS_H_ @@ -23,12 +21,12 @@ extern char **new_list(char *value); extern bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw - , char *base, bool *assigned); + , char *base, bool *assigned); extern void free_args(kw_token_t first, kw_token_t last, char *base); extern void clone_args(kw_token_t first, kw_token_t last, char *base1 - , char *base2); + , char *base2); extern bool cmp_args(kw_token_t first, kw_token_t last, char *base1 - , char *base2); + , char *base2); #endif /* _ARGS_H_ */ diff --git a/src/starter/cmp.c b/src/starter/cmp.c index 5abb8399b..8462a4819 100644 --- a/src/starter/cmp.c +++ b/src/starter/cmp.c @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: cmp.c 3881 2008-04-27 11:04:13Z andreas $ */ #include <string.h> @@ -34,79 +32,79 @@ static bool starter_cmp_end(starter_end_t *c1, starter_end_t *c2) { - if ((c1 == NULL) || (c2 == NULL)) - return FALSE; - - if (c2->dns_failed) - { - c2->addr = c1->addr; - } - else - { - ADDCMP(addr); - } - ADDCMP(nexthop); - VARCMP(has_client); - VARCMP(has_client_wildcard); - VARCMP(has_port_wildcard); - VARCMP(has_natip); - VARCMP(has_virt); - VARCMP(modecfg); - VARCMP(port); - VARCMP(protocol); - - return cmp_args(KW_END_FIRST, KW_END_LAST, (char *)c1, (char *)c2); + if ((c1 == NULL) || (c2 == NULL)) + return FALSE; + + if (c2->dns_failed) + { + c2->addr = c1->addr; + } + else + { + ADDCMP(addr); + } + ADDCMP(nexthop); + VARCMP(has_client); + VARCMP(has_client_wildcard); + VARCMP(has_port_wildcard); + VARCMP(has_natip); + VARCMP(has_virt); + VARCMP(modecfg); + VARCMP(port); + VARCMP(protocol); + + return cmp_args(KW_END_FIRST, KW_END_LAST, (char *)c1, (char *)c2); } bool starter_cmp_conn(starter_conn_t *c1, starter_conn_t *c2) { - if ((c1 == NULL) || (c2 == NULL)) - return FALSE; + if ((c1 == NULL) || (c2 == NULL)) + return FALSE; - VARCMP(policy); - VARCMP(addr_family); - VARCMP(tunnel_addr_family); + VARCMP(policy); + VARCMP(addr_family); + VARCMP(tunnel_addr_family); - if (!starter_cmp_end(&c1->left, &c2->left)) - return FALSE; - if (!starter_cmp_end(&c1->right, &c2->right)) - return FALSE; + if (!starter_cmp_end(&c1->left, &c2->left)) + return FALSE; + if (!starter_cmp_end(&c1->right, &c2->right)) + return FALSE; - return cmp_args(KW_CONN_NAME, KW_CONN_LAST, (char *)c1, (char *)c2); + return cmp_args(KW_CONN_NAME, KW_CONN_LAST, (char *)c1, (char *)c2); } bool starter_cmp_ca(starter_ca_t *c1, starter_ca_t *c2) { - if (c1 == NULL || c2 == NULL) - return FALSE; + if (c1 == NULL || c2 == NULL) + return FALSE; - return cmp_args(KW_CA_NAME, KW_CA_LAST, (char *)c1, (char *)c2); + return cmp_args(KW_CA_NAME, KW_CA_LAST, (char *)c1, (char *)c2); } bool starter_cmp_klips(starter_config_t *c1, starter_config_t *c2) { - if ((c1 == NULL) || (c2 == NULL)) - return FALSE; + if ((c1 == NULL) || (c2 == NULL)) + return FALSE; - return cmp_args(KW_KLIPS_FIRST, KW_KLIPS_LAST, (char *)c1, (char *)c2); + return cmp_args(KW_KLIPS_FIRST, KW_KLIPS_LAST, (char *)c1, (char *)c2); } bool starter_cmp_pluto(starter_config_t *c1, starter_config_t *c2) { - if ((c1 == NULL) || (c2 == NULL)) - return FALSE; + if ((c1 == NULL) || (c2 == NULL)) + return FALSE; - return cmp_args(KW_PLUTO_FIRST, KW_PLUTO_LAST, (char *)c1, (char *)c2); + return cmp_args(KW_PLUTO_FIRST, KW_PLUTO_LAST, (char *)c1, (char *)c2); } bool starter_cmp_defaultroute(defaultroute_t *d1, defaultroute_t *d2) { - if ((d1 == NULL) || (d2 == NULL)) - return FALSE; - return memcmp(d1, d2, sizeof(defaultroute_t)) == 0; + if ((d1 == NULL) || (d2 == NULL)) + return FALSE; + return memcmp(d1, d2, sizeof(defaultroute_t)) == 0; } diff --git a/src/starter/cmp.h b/src/starter/cmp.h index 24bd32ff6..cda6e44b9 100644 --- a/src/starter/cmp.h +++ b/src/starter/cmp.h @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: cmp.h 3267 2007-10-08 19:57:54Z andreas $ */ #ifndef _STARTER_CMP_H_ diff --git a/src/starter/confread.c b/src/starter/confread.c index 855d07b51..5fd2b9fbf 100644 --- a/src/starter/confread.c +++ b/src/starter/confread.c @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: confread.c 5002 2009-03-24 15:02:12Z martin $ */ #include <stddef.h> @@ -34,8 +32,8 @@ /* strings containing a colon are interpreted as an IPv6 address */ #define ip_version(string) (strchr(string, '.') ? AF_INET : AF_INET6) -static const char ike_defaults[] = "aes128-sha-modp2048"; -static const char esp_defaults[] = "aes128-sha1, 3des-md5"; +static const char ike_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536"; +static const char esp_defaults[] = "aes128-sha1,3des-sha1"; static const char firewall_defaults[] = "ipsec _updown iptables"; @@ -72,11 +70,11 @@ static void default_values(starter_config_t *cfg) cfg->conn_default.seen = LEMPTY; cfg->conn_default.startup = STARTUP_NO; cfg->conn_default.state = STATE_IGNORE; - cfg->conn_default.policy = POLICY_ENCRYPT | POLICY_TUNNEL | POLICY_RSASIG | + cfg->conn_default.policy = POLICY_ENCRYPT | POLICY_TUNNEL | POLICY_PUBKEY | POLICY_PFS | POLICY_MOBIKE; - cfg->conn_default.ike = clone_str(ike_defaults, "ike_defaults"); - cfg->conn_default.esp = clone_str(esp_defaults, "esp_defaults"); + cfg->conn_default.ike = clone_str(ike_defaults); + cfg->conn_default.esp = clone_str(esp_defaults); cfg->conn_default.sa_ike_life_seconds = OAKLEY_ISAKMP_SA_LIFETIME_DEFAULT; cfg->conn_default.sa_ipsec_life_seconds = PLUTO_SA_LIFE_DURATION_DEFAULT; cfg->conn_default.sa_rekey_margin = SA_REPLACEMENT_MARGIN_DEFAULT; @@ -144,7 +142,7 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token { err_t ugh = NULL; bool assigned = FALSE; - int has_port_wildcard; /* set if port is %any */ + bool has_port_wildcard; /* set if port is %any */ char *name = kw->entry->name; char *value = kw->value; @@ -193,7 +191,7 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token if (streq(value, "%modeconfig") || streq(value, "%modecfg") || streq(value, "%config") || streq(value, "%cfg")) { - pfree(end->srcip); + free(end->srcip); end->srcip = NULL; end->modecfg = TRUE; } @@ -336,7 +334,7 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token plog("# bad subnet: %s=%s [%s]", name, value, ugh); goto err; } - end->subnet = clone_str(value, "subnetwithin"); + end->subnet = clone_str(value); break; } case KW_PROTOPORT: @@ -356,7 +354,7 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token if (cfg->defaultroute.defined) { addrtot(&cfg->defaultroute.addr, 0, buf, sizeof(buf)); - end->srcip = clone_str(buf, "natip"); + end->srcip = clone_str(buf); } else { @@ -375,7 +373,7 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token plog("# bad addr: %s=%s [%s]", name, value, ugh); goto err; } - end->srcip = clone_str(value, "srcip"); + end->srcip = clone_str(value); } end->has_natip = TRUE; conn->policy |= POLICY_TUNNEL; @@ -426,7 +424,7 @@ handle_firewall( const char *label, starter_end_t *end, starter_config_t *cfg) } else { - end->updown = clone_str(firewall_defaults, "firewall_defaults"); + end->updown = clone_str(firewall_defaults); end->firewall = FALSE; } } @@ -467,9 +465,9 @@ load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg) { if (cfg->parse_also) { - also_t *also = alloc_thing(also_t, "also_t"); + also_t *also = malloc_thing(also_t); - also->name = clone_str(kw->value, "also"); + also->name = clone_str(kw->value); also->next = conn->also; conn->also = also; @@ -557,18 +555,16 @@ load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg) /* also handles the cases secret|rsasig and rsasig|secret */ for (;;) { - if (streq(value, "rsa") || streq(value, "rsasig")) + if (streq(value, "rsa") || streq(value, "rsasig") || + streq(value, "ecdsa") || streq(value, "ecdsasig") || + streq(value, "pubkey")) { - conn->policy |= POLICY_RSASIG | POLICY_ENCRYPT; + conn->policy |= POLICY_PUBKEY | POLICY_ENCRYPT; } else if (streq(value, "secret") || streq(value, "psk")) { conn->policy |= POLICY_PSK | POLICY_ENCRYPT; } - else if (streq(value, "ecdsa") || streq(value, "ecdsasig")) - { - conn->policy |= POLICY_ECDSASIG | POLICY_ENCRYPT; - } else if (streq(value, "xauthrsasig")) { conn->policy |= POLICY_XAUTH_RSASIG | POLICY_ENCRYPT; @@ -698,7 +694,7 @@ static void conn_default(char *name, starter_conn_t *conn, starter_conn_t *def) { memcpy(conn, def, sizeof(starter_conn_t)); - conn->name = clone_str(name, "conn name"); + conn->name = clone_str(name); clone_args(KW_CONN_FIRST, KW_CONN_LAST, (char *)conn, (char *)def); clone_args(KW_END_FIRST, KW_END_LAST, (char *)&conn->left, (char *)&def->left); @@ -727,9 +723,9 @@ load_ca(starter_ca_t *ca, kw_list_t *kw, starter_config_t *cfg) { if (cfg->parse_also) { - also_t *also = alloc_thing(also_t, "also_t"); + also_t *also = malloc_thing(also_t); - also->name = clone_str(kw->value, "also"); + also->name = clone_str(kw->value); also->next = ca->also; ca->also = also; @@ -766,7 +762,7 @@ static void ca_default(char *name, starter_ca_t *ca, starter_ca_t *def) { memcpy(ca, def, sizeof(starter_ca_t)); - ca->name = clone_str(name, "ca name"); + ca->name = clone_str(name); clone_args(KW_CA_FIRST, KW_CA_LAST, (char *)ca, (char *)def); } @@ -896,8 +892,8 @@ free_also(also_t *head) also_t *also = head; head = also->next; - pfree(also->name); - pfree(also); + free(also->name); + free(also); } } @@ -942,7 +938,7 @@ confread_free(starter_config_t *cfg) conn = conn->next; confread_free_conn(conn_aux); - pfree(conn_aux); + free(conn_aux); } confread_free_ca(&cfg->ca_default); @@ -953,10 +949,10 @@ confread_free(starter_config_t *cfg) ca = ca->next; confread_free_ca(ca_aux); - pfree(ca_aux); + free(ca_aux); } - pfree(cfg); + free(cfg); } /* @@ -980,7 +976,7 @@ confread_load(const char *file) { return NULL; } - cfg = (starter_config_t *)alloc_thing(starter_config_t, "starter_config_t"); + cfg = malloc_thing(starter_config_t); /* set default values */ default_values(cfg); @@ -1021,7 +1017,7 @@ confread_load(const char *file) DBG(DBG_CONTROL, DBG_log("Loading ca '%s'", sca->name) ) - ca = (starter_ca_t *)alloc_thing(starter_ca_t, "starter_ca_t"); + ca = malloc_thing(starter_ca_t); ca_default(sca->name, ca, &cfg->ca_default); ca->kw = sca->kw; @@ -1092,7 +1088,7 @@ confread_load(const char *file) DBG(DBG_CONTROL, DBG_log("Loading conn '%s'", sconn->name) ) - conn = (starter_conn_t *)alloc_thing(starter_conn_t, "starter_conn_t"); + conn = malloc_thing(starter_conn_t); conn_default(sconn->name, conn, &cfg->conn_default); conn->kw = sconn->kw; diff --git a/src/starter/confread.h b/src/starter/confread.h index 24a8d073e..b20c2e0d3 100644 --- a/src/starter/confread.h +++ b/src/starter/confread.h @@ -11,8 +11,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: confread.h 4612 2008-11-11 06:37:37Z andreas $ */ #ifndef _IPSEC_CONFREAD_H_ @@ -20,205 +18,209 @@ #ifndef _FREESWAN_H #include <freeswan.h> -#include "../pluto/constants.h" #endif #include "parser.h" #include "interfaces.h" typedef enum { - STARTUP_NO, - STARTUP_ADD, - STARTUP_ROUTE, - STARTUP_START + STARTUP_NO, + STARTUP_ADD, + STARTUP_ROUTE, + STARTUP_START } startup_t; typedef enum { - STATE_IGNORE, - STATE_TO_ADD, - STATE_ADDED, - STATE_REPLACED, - STATE_INVALID + STATE_IGNORE, + STATE_TO_ADD, + STATE_ADDED, + STATE_REPLACED, + STATE_INVALID } starter_state_t; typedef enum { - KEY_EXCHANGE_IKE, - KEY_EXCHANGE_IKEV1, - KEY_EXCHANGE_IKEV2 + KEY_EXCHANGE_IKE, + KEY_EXCHANGE_IKEV1, + KEY_EXCHANGE_IKEV2 } keyexchange_t; typedef enum { - STRICT_NO, - STRICT_YES, - STRICT_IFURI + STRICT_NO, + STRICT_YES, + STRICT_IFURI } strict_t; typedef struct starter_end starter_end_t; struct starter_end { - lset_t seen; - char *id; - char *rsakey; - char *cert; - char *ca; - char *groups; - char *iface; - ip_address addr; - ip_address nexthop; - char *subnet; - bool has_client; - bool has_client_wildcard; - bool has_port_wildcard; - bool has_natip; - bool has_virt; - bool modecfg; - certpolicy_t sendcert; - bool firewall; - bool hostaccess; - bool allow_any; - bool dns_failed; - char *updown; - u_int16_t port; - u_int8_t protocol; - char *srcip; + lset_t seen; + char *auth; + char *auth2; + char *id; + char *id2; + char *rsakey; + char *cert; + char *cert2; + char *ca; + char *ca2; + char *groups; + char *iface; + ip_address addr; + ip_address nexthop; + char *subnet; + bool has_client; + bool has_client_wildcard; + bool has_port_wildcard; + bool has_natip; + bool has_virt; + bool modecfg; + certpolicy_t sendcert; + bool firewall; + bool hostaccess; + bool allow_any; + bool dns_failed; + char *updown; + u_int16_t port; + u_int8_t protocol; + char *srcip; }; typedef struct also also_t; struct also { - char *name; - bool included; - also_t *next; + char *name; + bool included; + also_t *next; }; typedef struct starter_conn starter_conn_t; struct starter_conn { - lset_t seen; - char *name; - also_t *also; - kw_list_t *kw; - u_int visit; - startup_t startup; - starter_state_t state; - - keyexchange_t keyexchange; - u_int32_t eap_type; - u_int32_t eap_vendor; - char *eap_identity; - lset_t policy; - time_t sa_ike_life_seconds; - time_t sa_ipsec_life_seconds; - time_t sa_rekey_margin; - unsigned long sa_keying_tries; - unsigned long sa_rekey_fuzz; - sa_family_t addr_family; - sa_family_t tunnel_addr_family; - bool install_policy; - starter_end_t left, right; - - unsigned long id; - - char *esp; - char *ike; - char *pfsgroup; - - time_t dpd_delay; - time_t dpd_timeout; - dpd_action_t dpd_action; - int dpd_count; - - bool me_mediation; - char *me_mediated_by; - char *me_peerid; - - starter_conn_t *next; + lset_t seen; + char *name; + also_t *also; + kw_list_t *kw; + u_int visit; + startup_t startup; + starter_state_t state; + + keyexchange_t keyexchange; + u_int32_t eap_type; + u_int32_t eap_vendor; + char *eap_identity; + lset_t policy; + time_t sa_ike_life_seconds; + time_t sa_ipsec_life_seconds; + time_t sa_rekey_margin; + unsigned long sa_keying_tries; + unsigned long sa_rekey_fuzz; + sa_family_t addr_family; + sa_family_t tunnel_addr_family; + bool install_policy; + starter_end_t left, right; + + unsigned long id; + + char *esp; + char *ike; + char *pfsgroup; + + time_t dpd_delay; + time_t dpd_timeout; + dpd_action_t dpd_action; + int dpd_count; + + bool me_mediation; + char *me_mediated_by; + char *me_peerid; + + starter_conn_t *next; }; typedef struct starter_ca starter_ca_t; struct starter_ca { - lset_t seen; - char *name; - also_t *also; - kw_list_t *kw; - u_int visit; - startup_t startup; - starter_state_t state; - - char *cacert; - char *ldaphost; - char *ldapbase; - char *crluri; - char *crluri2; - char *ocspuri; - char *ocspuri2; - char *certuribase; - - bool strict; - - starter_ca_t *next; + lset_t seen; + char *name; + also_t *also; + kw_list_t *kw; + u_int visit; + startup_t startup; + starter_state_t state; + + char *cacert; + char *ldaphost; + char *ldapbase; + char *crluri; + char *crluri2; + char *ocspuri; + char *ocspuri2; + char *certuribase; + + bool strict; + + starter_ca_t *next; }; typedef struct starter_config starter_config_t; struct starter_config { - struct { - lset_t seen; - char **interfaces; - char *dumpdir; - bool charonstart; - bool plutostart; - - /* pluto/charon keywords */ - char **plutodebug; - char *charondebug; - char *prepluto; - char *postpluto; - char *plutostderrlog; - bool uniqueids; - u_int overridemtu; - u_int crlcheckinterval; - bool cachecrls; - strict_t strictcrlpolicy; - bool nocrsend; - bool nat_traversal; - u_int keep_alive; - u_int force_keepalive; - char *virtual_private; - char *pkcs11module; - char *pkcs11initargs; - bool pkcs11keepstate; - bool pkcs11proxy; - - /* KLIPS keywords */ - char **klipsdebug; - bool fragicmp; - char *packetdefault; - bool hidetos; - } setup; - - /* information about the default route */ - defaultroute_t defaultroute; - - /* number of encountered parsing errors */ - u_int err; - u_int non_fatal_err; - - /* do we parse also statements */ - bool parse_also; - - /* ca %default */ - starter_ca_t ca_default; - - /* connections list (without %default) */ - starter_ca_t *ca_first, *ca_last; - - /* conn %default */ - starter_conn_t conn_default; - - /* connections list (without %default) */ - starter_conn_t *conn_first, *conn_last; + struct { + lset_t seen; + char **interfaces; + char *dumpdir; + bool charonstart; + bool plutostart; + + /* pluto/charon keywords */ + char **plutodebug; + char *charondebug; + char *prepluto; + char *postpluto; + char *plutostderrlog; + bool uniqueids; + u_int overridemtu; + u_int crlcheckinterval; + bool cachecrls; + strict_t strictcrlpolicy; + bool nocrsend; + bool nat_traversal; + u_int keep_alive; + u_int force_keepalive; + char *virtual_private; + char *pkcs11module; + char *pkcs11initargs; + bool pkcs11keepstate; + bool pkcs11proxy; + + /* KLIPS keywords */ + char **klipsdebug; + bool fragicmp; + char *packetdefault; + bool hidetos; + } setup; + + /* information about the default route */ + defaultroute_t defaultroute; + + /* number of encountered parsing errors */ + u_int err; + u_int non_fatal_err; + + /* do we parse also statements */ + bool parse_also; + + /* ca %default */ + starter_ca_t ca_default; + + /* connections list (without %default) */ + starter_ca_t *ca_first, *ca_last; + + /* conn %default */ + starter_conn_t conn_default; + + /* connections list (without %default) */ + starter_conn_t *conn_first, *conn_last; }; extern starter_config_t *confread_load(const char *file); diff --git a/src/starter/exec.c b/src/starter/exec.c index eed444c74..d4c4f0657 100644 --- a/src/starter/exec.c +++ b/src/starter/exec.c @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: exec.c 3267 2007-10-08 19:57:54Z andreas $ */ #include <stdlib.h> @@ -37,18 +35,18 @@ int starter_exec(const char *fmt, ...) { - va_list args; - static char buf[BUF_SIZE]; - int r; - - va_start (args, fmt); - vsnprintf(buf, BUF_SIZE-1, fmt, args); - buf[BUF_SIZE - 1] = '\0'; - va_end(args); - r = system(buf); - DBG(DBG_CONTROL, - DBG_log("starter_exec(%s) = %d", buf, r) - ) - return r; + va_list args; + static char buf[BUF_SIZE]; + int r; + + va_start (args, fmt); + vsnprintf(buf, BUF_SIZE-1, fmt, args); + buf[BUF_SIZE - 1] = '\0'; + va_end(args); + r = system(buf); + DBG(DBG_CONTROL, + DBG_log("starter_exec(%s) = %d", buf, r) + ) + return r; } diff --git a/src/starter/exec.h b/src/starter/exec.h index 49d795e1a..6a6414578 100644 --- a/src/starter/exec.h +++ b/src/starter/exec.h @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: exec.h 3267 2007-10-08 19:57:54Z andreas $ */ #ifndef _STARTER_EXEC_H_ diff --git a/src/starter/files.h b/src/starter/files.h index a40574594..ec41c9f2e 100644 --- a/src/starter/files.h +++ b/src/starter/files.h @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: files.h 4618 2008-11-11 09:22:00Z tobias $ */ #ifndef _STARTER_FILES_H_ @@ -19,18 +17,18 @@ #define STARTER_PID_FILE IPSEC_PIDDIR "/starter.pid" -#define PROC_NETKEY "/proc/net/pfkey" -#define PROC_KLIPS "/proc/net/pf_key" -#define PROC_MODULES "/proc/modules" +#define PROC_NETKEY "/proc/net/pfkey" +#define PROC_KLIPS "/proc/net/pf_key" +#define PROC_MODULES "/proc/modules" #define CONFIG_FILE IPSEC_CONFDIR "/ipsec.conf" -#define SECRETS_FILE IPSEC_CONFDIR "/ipsec.secrets" +#define SECRETS_FILE IPSEC_CONFDIR "/ipsec.secrets" #define PLUTO_CMD IPSEC_DIR "/pluto" #define PLUTO_CTL_FILE IPSEC_PIDDIR "/pluto.ctl" #define PLUTO_PID_FILE IPSEC_PIDDIR "/pluto.pid" -#define CHARON_CMD IPSEC_DIR "/charon" +#define CHARON_CMD IPSEC_DIR "/charon" #define CHARON_CTL_FILE IPSEC_PIDDIR "/charon.ctl" #define CHARON_PID_FILE IPSEC_PIDDIR "/charon.pid" diff --git a/src/starter/interfaces.c b/src/starter/interfaces.c index 5cec8a217..034eac317 100644 --- a/src/starter/interfaces.c +++ b/src/starter/interfaces.c @@ -10,20 +10,16 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: interfaces.c 3267 2007-10-08 19:57:54Z andreas $ */ #include <sys/socket.h> #include <sys/ioctl.h> -#include <linux/if.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <freeswan.h> -#include <ipsec_tunnel.h> #include <constants.h> #include <defs.h> @@ -39,114 +35,114 @@ void get_defaultroute(defaultroute_t *defaultroute) { - FILE *fd; - char line[BUF_LEN]; - bool first = TRUE; + FILE *fd; + char line[BUF_LEN]; + bool first = TRUE; - memset(defaultroute, 0, sizeof(defaultroute_t)); + memset(defaultroute, 0, sizeof(defaultroute_t)); - fd = fopen("/proc/net/route", "r"); + fd = fopen("/proc/net/route", "r"); - if (!fd) - { - plog("could not open 'proc/net/route'"); - return; - } - - while (fgets(line, sizeof(line), fd) != 0) - { - char iface[11]; - char destination[9]; - char gateway[11]; - char flags[5]; - char mask[9]; - - int refcnt; - int use; - int metric; - int items; - - /* proc/net/route returns IP addresses in host order */ - strcpy(gateway, "0h"); - - /* skip the header line */ - if (first) + if (!fd) { - first = FALSE; - continue; + plog("could not open 'proc/net/route'"); + return; } - /* parsing a single line of proc/net/route */ - items = sscanf(line, "%10s\t%8s\t%8s\t%5s\t%d\t%d\t%d\t%8s\t" - , iface, destination, gateway+2, flags, &refcnt, &use, &metric, mask); - if (items < 8) + while (fgets(line, sizeof(line), fd) != 0) { - plog("parsing error while scanning /proc/net/route"); - continue; + char iface[11]; + char destination[9]; + char gateway[11]; + char flags[5]; + char mask[9]; + + int refcnt; + int use; + int metric; + int items; + + /* proc/net/route returns IP addresses in host order */ + strcpy(gateway, "0h"); + + /* skip the header line */ + if (first) + { + first = FALSE; + continue; + } + + /* parsing a single line of proc/net/route */ + items = sscanf(line, "%10s\t%8s\t%8s\t%5s\t%d\t%d\t%d\t%8s\t" + , iface, destination, gateway+2, flags, &refcnt, &use, &metric, mask); + if (items < 8) + { + plog("parsing error while scanning /proc/net/route"); + continue; + } + + /* check for defaultroute (destination 0.0.0.0 and mask 0.0.0.0) */ + if (streq(destination, "00000000") && streq(mask, "00000000")) + { + if (defaultroute->defined) + { + plog("multiple default routes - cannot cope with %%defaultroute!!!"); + defaultroute->defined = FALSE; + fclose(fd); + return; + } + ttoaddr(gateway, strlen(gateway), AF_INET, &defaultroute->nexthop); + strncpy(defaultroute->iface, iface, IFNAMSIZ); + defaultroute->defined = TRUE; + } } + fclose(fd); - /* check for defaultroute (destination 0.0.0.0 and mask 0.0.0.0) */ - if (streq(destination, "00000000") && streq(mask, "00000000")) + if (!defaultroute->defined) { - if (defaultroute->defined) - { - plog("multiple default routes - cannot cope with %%defaultroute!!!"); - defaultroute->defined = FALSE; - fclose(fd); - return; - } - ttoaddr(gateway, strlen(gateway), AF_INET, &defaultroute->nexthop); - strncpy(defaultroute->iface, iface, IFNAMSIZ); - defaultroute->defined = TRUE; + plog("no default route - cannot cope with %%defaultroute!!!"); } - } - fclose(fd); - - if (!defaultroute->defined) - { - plog("no default route - cannot cope with %%defaultroute!!!"); - } - else - { - char addr_buf[20], nexthop_buf[20]; - struct ifreq physreq; - - int sock = socket(AF_INET, SOCK_DGRAM, 0); - - /* determine IP address of iface */ - if (sock < 0) + else { - plog("could not open SOCK_DGRAM socket"); - defaultroute->defined = FALSE; - return; + char addr_buf[20], nexthop_buf[20]; + struct ifreq physreq; + + int sock = socket(AF_INET, SOCK_DGRAM, 0); + + /* determine IP address of iface */ + if (sock < 0) + { + plog("could not open SOCK_DGRAM socket"); + defaultroute->defined = FALSE; + return; + } + memset ((void*)&physreq, 0, sizeof(physreq)); + strncpy(physreq.ifr_name, defaultroute->iface, IFNAMSIZ); + ioctl(sock, SIOCGIFADDR, &physreq); + close(sock); + defaultroute->addr.u.v4 = *((struct sockaddr_in *)&physreq.ifr_addr); + + addrtot(&defaultroute->addr, 0, addr_buf, sizeof(addr_buf)); + addrtot(&defaultroute->nexthop, 0, nexthop_buf, sizeof(nexthop_buf)); + + DBG(DBG_CONTROL, + DBG_log("Default route found: iface=%s, addr=%s, nexthop=%s" + , defaultroute->iface, addr_buf, nexthop_buf) + ) + + /* for backwards-compatibility with the awk shell scripts + * store the defaultroute in /var/run/ipsec.info + */ + fd = fopen(INFO_FILE, "w"); + + if (fd) + { + fprintf(fd, "defaultroutephys=%s\n", defaultroute->iface ); + fprintf(fd, "defaultroutevirt=ipsec0\n"); + fprintf(fd, "defaultrouteaddr=%s\n", addr_buf); + fprintf(fd, "defaultroutenexthop=%s\n", nexthop_buf); + fclose(fd); + } } - memset ((void*)&physreq, 0, sizeof(physreq)); - strncpy(physreq.ifr_name, defaultroute->iface, IFNAMSIZ); - ioctl(sock, SIOCGIFADDR, &physreq); - close(sock); - defaultroute->addr.u.v4 = *((struct sockaddr_in *)&physreq.ifr_addr); - - addrtot(&defaultroute->addr, 0, addr_buf, sizeof(addr_buf)); - addrtot(&defaultroute->nexthop, 0, nexthop_buf, sizeof(nexthop_buf)); - - DBG(DBG_CONTROL, - DBG_log("Default route found: iface=%s, addr=%s, nexthop=%s" - , defaultroute->iface, addr_buf, nexthop_buf) - ) - - /* for backwards-compatibility with the awk shell scripts - * store the defaultroute in /var/run/ipsec.info - */ - fd = fopen(INFO_FILE, "w"); - - if (fd) - { - fprintf(fd, "defaultroutephys=%s\n", defaultroute->iface ); - fprintf(fd, "defaultroutevirt=ipsec0\n"); - fprintf(fd, "defaultrouteaddr=%s\n", addr_buf); - fprintf(fd, "defaultroutenexthop=%s\n", nexthop_buf); - fclose(fd); - } - } - return; + return; } diff --git a/src/starter/interfaces.h b/src/starter/interfaces.h index 299113669..abe4c8f9c 100644 --- a/src/starter/interfaces.h +++ b/src/starter/interfaces.h @@ -10,22 +10,22 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: interfaces.h 3267 2007-10-08 19:57:54Z andreas $ */ #ifndef _STARTER_INTERFACES_H_ #define _STARTER_INTERFACES_H_ -#include <linux/if.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <net/if.h> #include "../pluto/constants.h" typedef struct { - bool defined; - char iface[IFNAMSIZ]; - ip_address addr; - ip_address nexthop; + bool defined; + char iface[IFNAMSIZ]; + ip_address addr; + ip_address nexthop; } defaultroute_t; extern void get_defaultroute(defaultroute_t *defaultroute); diff --git a/src/starter/invokecharon.c b/src/starter/invokecharon.c index dd3f5f018..804467cea 100644 --- a/src/starter/invokecharon.c +++ b/src/starter/invokecharon.c @@ -13,8 +13,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: invokecharon.c 5050 2009-03-27 16:14:59Z andreas $ */ #include <sys/types.h> @@ -41,190 +39,197 @@ static int _stop_requested; pid_t starter_charon_pid(void) { - return _charon_pid; + return _charon_pid; } void starter_charon_sigchild(pid_t pid) { - if (pid == _charon_pid) - { - _charon_pid = 0; - if (!_stop_requested) + if (pid == _charon_pid) { - plog("charon has died -- restart scheduled (%dsec)" - , CHARON_RESTART_DELAY); - alarm(CHARON_RESTART_DELAY); // restart in 5 sec + _charon_pid = 0; + if (!_stop_requested) + { + plog("charon has died -- restart scheduled (%dsec)" + , CHARON_RESTART_DELAY); + alarm(CHARON_RESTART_DELAY); // restart in 5 sec + } + unlink(CHARON_PID_FILE); } - unlink(CHARON_PID_FILE); - } } int starter_stop_charon (void) { - int i; - pid_t pid = _charon_pid; + int i; + pid_t pid = _charon_pid; - if (pid) - { - _stop_requested = 1; - - /* be more and more aggressive */ - for (i = 0; i < 50 && (pid = _charon_pid) != 0; i++) + if (pid) { - if (i == 0) - { - kill(pid, SIGINT); - } - else if (i < 40) - { - kill(pid, SIGTERM); - } - else if (i == 40) - { - kill(pid, SIGKILL); - plog("starter_stop_charon(): charon does not respond, sending KILL"); - } - else - { - kill(pid, SIGKILL); - } - usleep(200000); /* sleep for 200 ms */ + _stop_requested = 1; + + /* be more and more aggressive */ + for (i = 0; i < 50 && (pid = _charon_pid) != 0; i++) + { + if (i == 0) + { + kill(pid, SIGINT); + } + else if (i < 40) + { + kill(pid, SIGTERM); + } + else if (i == 40) + { + kill(pid, SIGKILL); + plog("starter_stop_charon(): charon does not respond, sending KILL"); + } + else + { + kill(pid, SIGKILL); + } + usleep(200000); /* sleep for 200 ms */ + } + if (_charon_pid == 0) + { + plog("charon stopped after %d ms", 200*i); + return 0; + } + plog("starter_stop_charon(): can't stop charon !!!"); + return -1; } - if (_charon_pid == 0) + else { - plog("charon stopped after %d ms", 200*i); - return 0; + plog("stater_stop_charon(): charon was not started..."); } - plog("starter_stop_charon(): can't stop charon !!!"); return -1; - } - else - { - plog("stater_stop_charon(): charon was not started..."); - } - return -1; } int -starter_start_charon (starter_config_t *cfg, bool no_fork) +starter_start_charon (starter_config_t *cfg, bool no_fork, bool attach_gdb) { - struct stat stb; - int pid, i; - char buffer[BUF_LEN]; - int argc = 1; - char *arg[] = { - CHARON_CMD, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, - NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, - NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, - NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL - }; - - if (!no_fork) - { - arg[argc++] = "--use-syslog"; - } - - /* parse debug string */ - { - int level; - char type[4]; - char *pos = cfg->setup.charondebug; - char *buf_pos = buffer; - - while (pos && sscanf(pos, "%4s %d,", type, &level) == 2) - { - snprintf(buf_pos, buffer + sizeof(buffer) - buf_pos, "--debug-%s", type); - arg[argc++] = buf_pos; - buf_pos += strlen(buf_pos) + 1; - if (buf_pos >= buffer + sizeof(buffer)) - { - break; - } - snprintf(buf_pos, buffer + sizeof(buffer) - buf_pos, "%d", level); - arg[argc++] = buf_pos; - buf_pos += strlen(buf_pos) + 1; - if (buf_pos >= buffer + sizeof(buffer)) - { - break; - } + struct stat stb; + int pid, i; + char buffer[BUF_LEN]; + int argc = 1; + char *arg[] = { + CHARON_CMD, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, + NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, + NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, + NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL + }; - /* get next */ - pos = strchr(pos, ','); - if (pos) - { - pos++; - } + if (attach_gdb) + { + argc = 0; + arg[argc++] = "/usr/bin/gdb"; + arg[argc++] = "--args"; + arg[argc++] = CHARON_CMD; + } + if (!no_fork) + { + arg[argc++] = "--use-syslog"; } - } - if (_charon_pid) - { - plog("starter_start_charon(): charon already started..."); - return -1; - } - else - { - unlink(CHARON_CTL_FILE); - _stop_requested = 0; - - pid = fork(); - switch (pid) + /* parse debug string */ { - case -1: - plog("can't fork(): %s", strerror(errno)); - return -1; - case 0: - /* child */ - setsid(); - sigprocmask(SIG_SETMASK, 0, NULL); - /* disable glibc's malloc checker, conflicts with leak detective */ - setenv("MALLOC_CHECK_", "0", 1); - execv(arg[0], arg); - plog("can't execv(%s,...): %s", arg[0], strerror(errno)); - exit(1); - default: - /* father */ - _charon_pid = pid; - for (i = 0; i < 500 && _charon_pid; i++) - { - /* wait for charon for a maximum of 500 x 20 ms = 10 s */ - usleep(20000); - if (stat(CHARON_PID_FILE, &stb) == 0) + int level; + char type[4]; + char *pos = cfg->setup.charondebug; + char *buf_pos = buffer; + + while (pos && sscanf(pos, "%4s %d,", type, &level) == 2) { - plog("charon (%d) started after %d ms", _charon_pid, 20*(i+1)); - return 0; + snprintf(buf_pos, buffer + sizeof(buffer) - buf_pos, "--debug-%s", type); + arg[argc++] = buf_pos; + buf_pos += strlen(buf_pos) + 1; + if (buf_pos >= buffer + sizeof(buffer)) + { + break; + } + snprintf(buf_pos, buffer + sizeof(buffer) - buf_pos, "%d", level); + arg[argc++] = buf_pos; + buf_pos += strlen(buf_pos) + 1; + if (buf_pos >= buffer + sizeof(buffer)) + { + break; + } + + /* get next */ + pos = strchr(pos, ','); + if (pos) + { + pos++; + } } - } - if (_charon_pid) - { - /* If charon is started but with no ctl file, stop it */ - plog("charon too long to start... - kill kill"); - for (i = 0; i < 20 && (pid = _charon_pid) != 0; i++) + } + + if (_charon_pid) + { + plog("starter_start_charon(): charon already started..."); + return -1; + } + else + { + unlink(CHARON_CTL_FILE); + _stop_requested = 0; + + pid = fork(); + switch (pid) { - if (i == 0) - { - kill(pid, SIGINT); - } - else if (i < 10) - { - kill(pid, SIGTERM); - } - else - { - kill(pid, SIGKILL); - } - usleep(20000); /* sleep for 20 ms */ + case -1: + plog("can't fork(): %s", strerror(errno)); + return -1; + case 0: + /* child */ + setsid(); + sigprocmask(SIG_SETMASK, 0, NULL); + /* disable glibc's malloc checker, conflicts with leak detective */ + setenv("MALLOC_CHECK_", "0", 1); + execv(arg[0], arg); + plog("can't execv(%s,...): %s", arg[0], strerror(errno)); + exit(1); + default: + /* father */ + _charon_pid = pid; + for (i = 0; i < 500 && _charon_pid; i++) + { + /* wait for charon for a maximum of 500 x 20 ms = 10 s */ + usleep(20000); + if (stat(CHARON_PID_FILE, &stb) == 0) + { + plog("charon (%d) started after %d ms", _charon_pid, 20*(i+1)); + return 0; + } + } + if (_charon_pid) + { + /* If charon is started but with no ctl file, stop it */ + plog("charon too long to start... - kill kill"); + for (i = 0; i < 20 && (pid = _charon_pid) != 0; i++) + { + if (i == 0) + { + kill(pid, SIGINT); + } + else if (i < 10) + { + kill(pid, SIGTERM); + } + else + { + kill(pid, SIGKILL); + } + usleep(20000); /* sleep for 20 ms */ + } + } + else + { + plog("charon refused to be started"); + } + return -1; } - } - else - { - plog("charon refused to be started"); - } - return -1; } - } - return -1; + return -1; } diff --git a/src/starter/invokecharon.h b/src/starter/invokecharon.h index c24d9bdb4..f0f470a8d 100644 --- a/src/starter/invokecharon.h +++ b/src/starter/invokecharon.h @@ -13,8 +13,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: invokecharon.h 3267 2007-10-08 19:57:54Z andreas $ */ #ifndef _STARTER_CHARON_H_ @@ -25,7 +23,7 @@ extern void starter_charon_sigchild (pid_t pid); extern pid_t starter_charon_pid (void); extern int starter_stop_charon (void); -extern int starter_start_charon(struct starter_config *cfg, bool debug); +extern int starter_start_charon(struct starter_config *cfg, bool no_fork, bool attach_gdb); #endif /* _STARTER_CHARON_H_ */ diff --git a/src/starter/invokepluto.c b/src/starter/invokepluto.c index edc587124..28bd93c5d 100644 --- a/src/starter/invokepluto.c +++ b/src/starter/invokepluto.c @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: invokepluto.c 5050 2009-03-27 16:14:59Z andreas $ */ #include <sys/types.h> @@ -40,267 +38,277 @@ static int _stop_requested; pid_t starter_pluto_pid(void) { - return _pluto_pid; + return _pluto_pid; } void starter_pluto_sigchild(pid_t pid) { - if (pid == _pluto_pid) - { - _pluto_pid = 0; - if (!_stop_requested) + if (pid == _pluto_pid) { - plog("pluto has died -- restart scheduled (%dsec)" - , PLUTO_RESTART_DELAY); - alarm(PLUTO_RESTART_DELAY); // restart in 5 sec + _pluto_pid = 0; + if (!_stop_requested) + { + plog("pluto has died -- restart scheduled (%dsec)" + , PLUTO_RESTART_DELAY); + alarm(PLUTO_RESTART_DELAY); // restart in 5 sec + } + unlink(PLUTO_PID_FILE); } - unlink(PLUTO_PID_FILE); - } } int starter_stop_pluto (void) { - int i; - pid_t pid = _pluto_pid; - - if (pid) - { - _stop_requested = 1; + int i; + pid_t pid = _pluto_pid; - if (starter_whack_shutdown() == 0) + if (pid) { - for (i = 0; i < 400; i++) - { - usleep(20000); /* sleep for 20 ms */ + _stop_requested = 1; + + if (starter_whack_shutdown() == 0) + { + for (i = 0; i < 400; i++) + { + usleep(20000); /* sleep for 20 ms */ + if (_pluto_pid == 0) + { + plog("pluto stopped after %d ms", 20*(i+1)); + return 0; + } + } + } + /* be more and more aggressive */ + for (i = 0; i < 20 && (pid = _pluto_pid) != 0; i++) + { + + if (i < 10) + { + kill(pid, SIGTERM); + } + if (i == 10) + { + kill(pid, SIGKILL); + plog("starter_stop_pluto(): pluto does not respond, sending KILL"); + } + else + { + kill(pid, SIGKILL); + } + usleep(100000); /* sleep for 100 ms */ + } if (_pluto_pid == 0) { - plog("pluto stopped after %d ms", 20*(i+1)); - return 0; + plog("pluto stopped after %d ms", 8000 + 100*i); + return 0; } - } - } - /* be more and more aggressive */ - for (i = 0; i < 20 && (pid = _pluto_pid) != 0; i++) - { - - if (i < 10) - { - kill(pid, SIGTERM); - } - if (i == 10) - { - kill(pid, SIGKILL); - plog("starter_stop_pluto(): pluto does not respond, sending KILL"); - } - else - { - kill(pid, SIGKILL); - } - usleep(100000); /* sleep for 100 ms */ + plog("starter_stop_pluto(): can't stop pluto !!!"); + return -1; } - if (_pluto_pid == 0) + else { - plog("pluto stopped after %d ms", 8000 + 100*i); - return 0; + plog("stater_stop_pluto(): pluto is not started..."); } - plog("starter_stop_pluto(): can't stop pluto !!!"); return -1; - } - else - { - plog("stater_stop_pluto(): pluto is not started..."); - } - return -1; } #define ADD_DEBUG(v) { \ - for (l = cfg->setup.plutodebug; l && *l; l++) if (streq(*l, v)) \ - arg[argc++] = "--debug-" v; \ - } + for (l = cfg->setup.plutodebug; l && *l; l++) if (streq(*l, v)) \ + arg[argc++] = "--debug-" v; \ + } int -starter_start_pluto (starter_config_t *cfg, bool no_fork) +starter_start_pluto (starter_config_t *cfg, bool no_fork, bool attach_gdb) { - struct stat stb; - int i; - pid_t pid; - char **l; - int argc = 2; - char *arg[] = { - PLUTO_CMD, "--nofork" - , NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL - , NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL - , NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL - , NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL - }; - - printf ("starter_start_pluto entered\n"); + struct stat stb; + int i; + pid_t pid; + char **l; + int argc = 2; + char *arg[] = { + PLUTO_CMD, "--nofork" + , NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL + , NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL + , NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL + , NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL + }; - if (cfg->setup.plutostderrlog || no_fork) - { - arg[argc++] = "--stderrlog"; - } - if (cfg->setup.uniqueids) - { - arg[argc++] = "--uniqueids"; - } - ADD_DEBUG("none") - ADD_DEBUG("all") - ADD_DEBUG("raw") - ADD_DEBUG("crypt") - ADD_DEBUG("parsing") - ADD_DEBUG("emitting") - ADD_DEBUG("control") - ADD_DEBUG("lifecycle") - ADD_DEBUG("klips") - ADD_DEBUG("dns") - ADD_DEBUG("natt") - ADD_DEBUG("oppo") - ADD_DEBUG("controlmore") - ADD_DEBUG("private") - if (cfg->setup.crlcheckinterval > 0) - { - static char buf1[15]; - - arg[argc++] = "--crlcheckinterval"; - snprintf(buf1, sizeof(buf1), "%u", cfg->setup.crlcheckinterval); - arg[argc++] = buf1; - } - if (cfg->setup.cachecrls) - { - arg[argc++] = "--cachecrls"; - } - if (cfg->setup.strictcrlpolicy) - { - arg[argc++] = "--strictcrlpolicy"; - } - if (cfg->setup.nocrsend) - { - arg[argc++] = "--nocrsend"; - } - if (cfg->setup.nat_traversal) - { - arg[argc++] = "--nat_traversal"; - } - if (cfg->setup.force_keepalive) - { - arg[argc++] = "--force_keepalive"; - } - if (cfg->setup.keep_alive) - { - static char buf2[15]; - - arg[argc++] = "--keep_alive"; - snprintf(buf2, sizeof(buf2), "%u", cfg->setup.keep_alive); - arg[argc++] = buf2; - } - if (cfg->setup.virtual_private) - { - arg[argc++] = "--virtual_private"; - arg[argc++] = cfg->setup.virtual_private; - } - if (cfg->setup.pkcs11module) - { - arg[argc++] = "--pkcs11module"; - arg[argc++] = cfg->setup.pkcs11module; - } - if (cfg->setup.pkcs11initargs) - { - arg[argc++] = "--pkcs11initargs"; - arg[argc++] = cfg->setup.pkcs11initargs; - } - if (cfg->setup.pkcs11keepstate) - { - arg[argc++] = "--pkcs11keepstate"; - } - if (cfg->setup.pkcs11proxy) - { - arg[argc++] = "--pkcs11proxy"; - } + printf ("starter_start_pluto entered\n"); + + if (attach_gdb) + { + argc = 0; + arg[argc++] = "/usr/bin/gdb"; + arg[argc++] = "--args"; + arg[argc++] = PLUTO_CMD; + arg[argc++] = "--nofork"; + } + if (cfg->setup.plutostderrlog || no_fork) + { + arg[argc++] = "--stderrlog"; + } + if (cfg->setup.uniqueids) + { + arg[argc++] = "--uniqueids"; + } + ADD_DEBUG("none") + ADD_DEBUG("all") + ADD_DEBUG("raw") + ADD_DEBUG("crypt") + ADD_DEBUG("parsing") + ADD_DEBUG("emitting") + ADD_DEBUG("control") + ADD_DEBUG("lifecycle") + ADD_DEBUG("klips") + ADD_DEBUG("dns") + ADD_DEBUG("natt") + ADD_DEBUG("oppo") + ADD_DEBUG("controlmore") + ADD_DEBUG("private") + if (cfg->setup.crlcheckinterval > 0) + { + static char buf1[15]; - if (_pluto_pid) - { - plog("starter_start_pluto(): pluto already started..."); - return -1; - } - else - { - unlink(PLUTO_CTL_FILE); - _stop_requested = 0; + arg[argc++] = "--crlcheckinterval"; + snprintf(buf1, sizeof(buf1), "%u", cfg->setup.crlcheckinterval); + arg[argc++] = buf1; + } + if (cfg->setup.cachecrls) + { + arg[argc++] = "--cachecrls"; + } + if (cfg->setup.strictcrlpolicy) + { + arg[argc++] = "--strictcrlpolicy"; + } + if (cfg->setup.nocrsend) + { + arg[argc++] = "--nocrsend"; + } + if (cfg->setup.nat_traversal) + { + arg[argc++] = "--nat_traversal"; + } + if (cfg->setup.force_keepalive) + { + arg[argc++] = "--force_keepalive"; + } + if (cfg->setup.keep_alive) + { + static char buf2[15]; - if (cfg->setup.prepluto) - ignore_result(system(cfg->setup.prepluto)); + arg[argc++] = "--keep_alive"; + snprintf(buf2, sizeof(buf2), "%u", cfg->setup.keep_alive); + arg[argc++] = buf2; + } + if (cfg->setup.virtual_private) + { + arg[argc++] = "--virtual_private"; + arg[argc++] = cfg->setup.virtual_private; + } + if (cfg->setup.pkcs11module) + { + arg[argc++] = "--pkcs11module"; + arg[argc++] = cfg->setup.pkcs11module; + } + if (cfg->setup.pkcs11initargs) + { + arg[argc++] = "--pkcs11initargs"; + arg[argc++] = cfg->setup.pkcs11initargs; + } + if (cfg->setup.pkcs11keepstate) + { + arg[argc++] = "--pkcs11keepstate"; + } + if (cfg->setup.pkcs11proxy) + { + arg[argc++] = "--pkcs11proxy"; + } - pid = fork(); - switch (pid) + if (_pluto_pid) + { + plog("starter_start_pluto(): pluto already started..."); + return -1; + } + else { - case -1: - plog("can't fork(): %s", strerror(errno)); - return -1; - case 0: - /* child */ - if (cfg->setup.plutostderrlog) - { - int f = creat(cfg->setup.plutostderrlog, 00644); + unlink(PLUTO_CTL_FILE); + _stop_requested = 0; - /* redirect stderr to file */ - if (f < 0) - { - plog("couldn't open stderr redirection file '%s'", - cfg->setup.plutostderrlog); - } - else - { - dup2(f, 2); - } - } - setsid(); - sigprocmask(SIG_SETMASK, 0, NULL); - execv(arg[0], arg); - plog("can't execv(%s,...): %s", arg[0], strerror(errno)); - exit(1); - default: - /* father */ - _pluto_pid = pid; - for (i = 0; i < 500 && _pluto_pid; i++) - { - /* wait for pluto for a maximum of 500 x 20 ms = 10 s */ - usleep(20000); - if (stat(PLUTO_CTL_FILE, &stb) == 0) - { - plog("pluto (%d) started after %d ms", _pluto_pid, 20*(i+1)); - if (cfg->setup.postpluto) - { - ignore_result(system(cfg->setup.postpluto)); - } - return 0; - } - } - if (_pluto_pid) - { - /* If pluto is started but with no ctl file, stop it */ - plog("pluto too long to start... - kill kill"); - for (i = 0; i < 20 && (pid = _pluto_pid) != 0; i++) + if (cfg->setup.prepluto) + ignore_result(system(cfg->setup.prepluto)); + + pid = fork(); + switch (pid) { - if (i < 10) - { - kill(pid, SIGTERM); - } - else - { - kill(pid, SIGKILL); - } - usleep(20000); /* sleep for 20 ms */ + case -1: + plog("can't fork(): %s", strerror(errno)); + return -1; + case 0: + /* child */ + if (cfg->setup.plutostderrlog) + { + int f = creat(cfg->setup.plutostderrlog, 00644); + + /* redirect stderr to file */ + if (f < 0) + { + plog("couldn't open stderr redirection file '%s'", + cfg->setup.plutostderrlog); + } + else + { + dup2(f, 2); + } + } + setsid(); + sigprocmask(SIG_SETMASK, 0, NULL); + /* disable glibc's malloc checker, conflicts with leak detective */ + setenv("MALLOC_CHECK_", "0", 1); + execv(arg[0], arg); + plog("can't execv(%s,...): %s", arg[0], strerror(errno)); + exit(1); + default: + /* father */ + _pluto_pid = pid; + for (i = 0; i < 500 && _pluto_pid; i++) + { + /* wait for pluto for a maximum of 500 x 20 ms = 10 s */ + usleep(20000); + if (stat(PLUTO_CTL_FILE, &stb) == 0) + { + plog("pluto (%d) started after %d ms", _pluto_pid, 20*(i+1)); + if (cfg->setup.postpluto) + { + ignore_result(system(cfg->setup.postpluto)); + } + return 0; + } + } + if (_pluto_pid) + { + /* If pluto is started but with no ctl file, stop it */ + plog("pluto too long to start... - kill kill"); + for (i = 0; i < 20 && (pid = _pluto_pid) != 0; i++) + { + if (i < 10) + { + kill(pid, SIGTERM); + } + else + { + kill(pid, SIGKILL); + } + usleep(20000); /* sleep for 20 ms */ + } + } + else + { + plog("pluto refused to be started"); + } + return -1; } - } - else - { - plog("pluto refused to be started"); - } - return -1; } - } - return -1; + return -1; } diff --git a/src/starter/invokepluto.h b/src/starter/invokepluto.h index 589a036ee..b0c89b1f1 100644 --- a/src/starter/invokepluto.h +++ b/src/starter/invokepluto.h @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: invokepluto.h 3267 2007-10-08 19:57:54Z andreas $ */ #ifndef _STARTER_PLUTO_H_ @@ -22,7 +20,7 @@ extern void starter_pluto_sigchild (pid_t pid); extern pid_t starter_pluto_pid (void); extern int starter_stop_pluto (void); -extern int starter_start_pluto (struct starter_config *cfg, bool debug); +extern int starter_start_pluto (struct starter_config *cfg, bool no_fork, bool attach_gdb); #endif /* _STARTER_PLUTO_H_ */ diff --git a/src/starter/ipsec.conf.5 b/src/starter/ipsec.conf.5 index 565f15c66..31e676324 100644 --- a/src/starter/ipsec.conf.5 +++ b/src/starter/ipsec.conf.5 @@ -1,5 +1,4 @@ .TH IPSEC.CONF 5 "27 Jun 2007" -.\" RCSID $Id: ipsec.conf.5 5002 2009-03-24 15:02:12Z martin $ .SH NAME ipsec.conf \- IPsec configuration and connections .SH DESCRIPTION @@ -239,27 +238,27 @@ acceptable values are .B secret or .B psk -for shared secrets, +for pre-shared secrets, +.B pubkey +(the default) for public key signatures as well as the synonyms .B rsasig -for RSA digital signatures (the default), -.B secret|rsasig -for either, and +for RSA digital signatures and +.B ecdsasig +for Elliptic Curve DSA signatures. .B never -if negotiation is never to be attempted or accepted (useful for shunt-only conns). -Digital signatures are superior in every way to shared secrets. In IKEv2, the -two ends must not agree on this parameter, it is relevant for the -outbound authentication method only. +can be used if negotiation is never to be attempted or accepted (useful for +shunt-only conns). +Digital signatures are superior in every way to shared secrets. IKEv1 additionally supports the values .B xauthpsk and .B xauthrsasig that will enable eXtended AUTHentication (XAUTH) in addition to IKEv1 main mode based on shared secrets or digital RSA signatures, respectively. -IKEv2 additionally supports the value -.B eap, -which indicates an initiator to request EAP authentication. The EAP method to -use is selected by the server (see -.B eap). +This parameter is deprecated for IKEv2 connections, as two peers do not need +to agree on an authentication method. Use the +.B leftauth +parameter instead to define authentication methods in IKEv2. .TP .B auto what operation, if any, should be done automatically at IPsec startup; @@ -350,25 +349,9 @@ in case of inactivity. This only applies to IKEv1, in IKEv2 the default retransmission timeout applies, as every exchange is used to detect dead peers. .TP .B eap -defines the EAP type to propose as server if the client has -.B authby=eap -selected. Acceptable values are -.B aka -for EAP-AKA, -.B sim -for EAP-SIM, -.B gtc -for EAP-GTC, -.B md5 -for EAP-MD5, and -.B mschapv2 -for EAP-MS-CHAPv2. -Additionally, IANA assigned EAP method numbers are accepted, or a definition -in the form -.B eap=type-vendor -(e.g. -.B eap=7-12345 -) can be used to specify vendor specific EAP types. +defines the EAP type to propose as server if the client requests EAP +authentication. This parameter is deprecated in the favour of +.B leftauth. To forward EAP authentication to a RADIUS server using the EAP-RADIUS plugin, set @@ -509,11 +492,46 @@ and .B no (the default). .TP +.B leftauth +Authentication method to use (local) or require (remote) in this connection. +This parameter is supported in IKEv2 only. Acceptable values are +.B pubkey +for public key authentication (RSA/ECDSA), +.B psk +for pre-shared key authentication and +.B eap +to (require the) use of the Extensible Authentication Protocol. In the case +of +.B eap, +an optional EAP method can be appended. Currently defined methods are +.B eap-aka, eap-sim, eap-gtc, eap-md5 +and +.B eap-mschapv2. +Alternatively, IANA assigned EAP method numbers are accepted. Vendor specific +EAP methods are defined in the form +.B eap-type-vendor +(e.g. +.B eap-7-12345 +). +.TP +.B leftauth2 +Same as +.B leftauth, +but defines an additional authentication exchange. IKEv2 supports multiple +authentication rounds using "Multiple Authentication Exchanges" defined +in RFC4739. This allows, for example, separated authentication +of host and user (IKEv2 only). +.TP .B leftca the distinguished name of a certificate authority which is required to lie in the trust path going from the left participant's certificate up to the root certification authority. .TP +.B leftca2 +Same as +.B leftca, +but for the second authentication round (IKEv2 only). +.TP .B leftcert the path to the left participant's X.509 certificate. The file can be coded either in PEM or DER format. OpenPGP certificates are supported as well. @@ -529,6 +547,11 @@ The left participant's ID can be overriden by specifying a .B leftid value which must be certified by the certificate, though. .TP +.B leftcert2 +Same as +.B leftcert, +but for the second authentication round (IKEv2 only). +.TP .B leftfirewall whether the left participant is doing forwarding-firewalling (including masquerading) using iptables for traffic from \fIleftsubnet\fR, @@ -594,6 +617,11 @@ or a fully-qualified domain name preceded by .B @ (which is used as a literal string and not resolved). .TP +.B leftid2 +identity to use for a second authentication for the left participant +(IKEv2 only); defaults to +.BR leftid . +.TP .B leftnexthop this parameter is not needed any more because the NETKEY IPsec stack does not require explicit routing entries for the traffic to be tunneled. diff --git a/src/starter/keywords.c b/src/starter/keywords.c index e51780dc1..3ca7a92f6 100644 --- a/src/starter/keywords.c +++ b/src/starter/keywords.c @@ -1,6 +1,6 @@ /* C code produced by gperf version 3.0.3 */ -/* Command-line: /usr/bin/gperf -C -G -t */ -/* Computed positions: -k'1-2,$' */ +/* Command-line: /usr/bin/gperf -m 10 -C -G -D -t */ +/* Computed positions: -k'1-2,6,$' */ #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \ && ('%' == 37) && ('&' == 38) && ('\'' == 39) && ('(' == 40) \ @@ -43,8 +43,6 @@ error "gperf generated tables don't work with this execution character set. Plea * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: keywords.txt 4612 2008-11-11 06:37:37Z andreas $ */ #include <string.h> @@ -56,12 +54,12 @@ struct kw_entry { kw_token_t token; }; -#define TOTAL_KEYWORDS 102 +#define TOTAL_KEYWORDS 112 #define MIN_WORD_LENGTH 3 #define MAX_WORD_LENGTH 17 -#define MIN_HASH_VALUE 6 -#define MAX_HASH_VALUE 248 -/* maximum key range = 243, duplicates = 0 */ +#define MIN_HASH_VALUE 13 +#define MAX_HASH_VALUE 200 +/* maximum key range = 188, duplicates = 0 */ #ifdef __GNUC__ __inline @@ -77,198 +75,192 @@ hash (str, len) { static const unsigned char asso_values[] = { - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 25, - 10, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 110, 249, 0, - 100, 5, 75, 65, 90, 0, 249, 60, 10, 15, - 80, 60, 15, 249, 0, 50, 35, 15, 30, 249, - 0, 75, 0, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249, 249, 249, 249, 249, - 249, 249, 249, 249, 249, 249 + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 3, + 42, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 1, 201, 9, 201, 5, + 39, 1, 64, 47, 62, 1, 201, 88, 5, 83, + 39, 30, 21, 201, 1, 10, 6, 44, 14, 201, + 4, 54, 4, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201, 201, 201, 201, 201, + 201, 201, 201, 201, 201, 201 }; - return len + asso_values[(unsigned char)str[1]] + asso_values[(unsigned char)str[0]] + asso_values[(unsigned char)str[len - 1]]; + register int hval = len; + + switch (hval) + { + default: + hval += asso_values[(unsigned char)str[5]]; + /*FALLTHROUGH*/ + case 5: + case 4: + case 3: + case 2: + hval += asso_values[(unsigned char)str[1]]; + /*FALLTHROUGH*/ + case 1: + hval += asso_values[(unsigned char)str[0]]; + break; + } + return hval + asso_values[(unsigned char)str[len - 1]]; } static const struct kw_entry wordlist[] = { - {""}, {""}, {""}, {""}, {""}, {""}, + {"right", KW_RIGHT}, {"crluri", KW_CRLURI}, - {""}, {""}, {""}, {""}, {""}, {""}, {""}, - {"rekeyfuzz", KW_REKEYFUZZ}, - {""}, {""}, - {"crluri2", KW_CRLURI2}, - {""}, {""}, {""}, - {"certuribase", KW_CERTURIBASE}, - {""}, - {"rightfirewall", KW_RIGHTFIREWALL}, - {""}, - {"rightnatip", KW_RIGHTNATIP}, - {"crlcheckinterval", KW_CRLCHECKINTERVAL}, - {"rightnexthop", KW_RIGHTNEXTHOP}, - {"rightsourceip", KW_RIGHTSOURCEIP}, - {""}, {""}, {""}, + {"left", KW_LEFT}, {"crluri1", KW_CRLURI}, - {""}, {""}, {""}, {""}, - {"leftfirewall", KW_LEFTFIREWALL}, - {""}, - {"leftnatip", KW_LEFTNATIP}, - {"right", KW_RIGHT}, - {"leftnexthop", KW_LEFTNEXTHOP}, - {"leftsourceip", KW_LEFTSOURCEIP}, - {""}, + {"certuribase", KW_CERTURIBASE}, + {"leftcert", KW_LEFTCERT,}, {"rightcert", KW_RIGHTCERT}, - {""}, + {"rightca", KW_RIGHTCA}, + {"leftfirewall", KW_LEFTFIREWALL}, + {"leftsendcert", KW_LEFTSENDCERT}, + {"leftprotoport", KW_LEFTPROTOPORT}, + {"leftgroups", KW_LEFTGROUPS}, + {"crlcheckinterval", KW_CRLCHECKINTERVAL}, {"rightsubnet", KW_RIGHTSUBNET}, - {""}, + {"leftca", KW_LEFTCA}, {"rightsendcert", KW_RIGHTSENDCERT}, - {"rightprotoport", KW_RIGHTPROTOPORT}, + {"cacert", KW_CACERT}, + {"eap", KW_EAP}, + {"esp", KW_ESP}, + {"cachecrls", KW_CACHECRLS}, + {"leftnexthop", KW_LEFTNEXTHOP}, {"virtual_private", KW_VIRTUAL_PRIVATE}, - {""}, {""}, {""}, - {"left", KW_LEFT}, - {""}, {""}, {""}, - {"leftcert", KW_LEFTCERT,}, - {""}, - {"leftsubnet", KW_LEFTSUBNET}, - {"rightgroups", KW_RIGHTGROUPS}, - {"leftsendcert", KW_LEFTSENDCERT}, - {"leftprotoport", KW_LEFTPROTOPORT}, - {""}, - {"righthostaccess", KW_RIGHTHOSTACCESS}, - {""}, + {"rightprotoport", KW_RIGHTPROTOPORT}, {"ocspuri", KW_OCSPURI}, - {"ike", KW_IKE}, - {""}, + {"leftnatip", KW_LEFTNATIP}, + {"rightsourceip", KW_RIGHTSOURCEIP}, + {"ocspuri1", KW_OCSPURI}, + {"also", KW_ALSO}, + {"rightid", KW_RIGHTID}, {"plutostart", KW_PLUTOSTART}, - {""}, {""}, - {"esp", KW_ESP}, - {""}, - {"leftgroups", KW_LEFTGROUPS}, - {"ikelifetime", KW_IKELIFETIME}, - {"keylife", KW_KEYLIFE}, - {"ocspuri2", KW_OCSPURI2}, + {"rightid2", KW_RIGHTID2}, + {"compress", KW_COMPRESS}, + {"packetdefault", KW_PACKETDEFAULT}, + {"crluri2", KW_CRLURI2}, + {"rightca2", KW_RIGHTCA2}, + {"leftcert2", KW_LEFTCERT2,}, + {"rightcert2", KW_RIGHTCERT2}, {"lefthostaccess", KW_LEFTHOSTACCESS}, - {"keep_alive", KW_KEEP_ALIVE}, - {"keyexchange", KW_KEYEXCHANGE}, - {""}, - {"prepluto", KW_PREPLUTO}, - {""}, {"rekey", KW_REKEY}, - {"mobike", KW_MOBIKE}, - {""}, - {"rightallowany", KW_RIGHTALLOWANY}, - {"rightrsasigkey", KW_RIGHTRSASIGKEY}, - {""}, - {"rightupdown", KW_RIGHTUPDOWN}, - {"pkcs11module", KW_PKCS11MODULE}, - {"ocspuri1", KW_OCSPURI}, - {""}, - {"pkcs11keepstate", KW_PKCS11KEEPSTATE}, - {"rekeymargin", KW_REKEYMARGIN}, + {"ldapbase", KW_LDAPBASE}, + {"rightauth2", KW_RIGHTAUTH2}, + {"leftca2", KW_LEFTCA2}, + {"type", KW_TYPE}, + {"leftsubnet", KW_LEFTSUBNET}, + {"nat_traversal", KW_NAT_TRAVERSAL}, {"rightsubnetwithin", KW_RIGHTSUBNETWITHIN}, - {"fragicmp", KW_FRAGICMP}, - {""}, - {"plutodebug", KW_PLUTODEBUG}, - {"reauth", KW_REAUTH}, + {"leftsourceip", KW_LEFTSOURCEIP}, + {"rightgroups", KW_RIGHTGROUPS}, + {"rightrsasigkey", KW_RIGHTRSASIGKEY}, + {"rightnatip", KW_RIGHTNATIP}, + {"rightnexthop", KW_RIGHTNEXTHOP}, + {"leftupdown", KW_LEFTUPDOWN}, {"leftallowany", KW_LEFTALLOWANY}, + {"rightallowany", KW_RIGHTALLOWANY}, + {"rekeyfuzz", KW_REKEYFUZZ}, + {"xauth", KW_XAUTH}, + {"rightauth", KW_RIGHTAUTH}, {"leftrsasigkey", KW_LEFTRSASIGKEY}, - {"plutostderrlog", KW_PLUTOSTDERRLOG}, - {"leftupdown", KW_LEFTUPDOWN}, - {"mediated_by", KW_MEDIATED_BY}, - {"rightid", KW_RIGHTID}, - {""}, - {"mediation", KW_MEDIATION}, - {""}, - {"leftsubnetwithin", KW_LEFTSUBNETWITHIN}, - {""}, - {"pfsgroup", KW_PFSGROUP}, - {""}, {""}, - {"overridemtu", KW_OVERRIDEMTU}, - {"rightca", KW_RIGHTCA}, - {"compress", KW_COMPRESS}, - {"type", KW_TYPE}, - {""}, + {"rightfirewall", KW_RIGHTFIREWALL}, + {"ocspuri2", KW_OCSPURI2}, + {"auto", KW_AUTO}, + {"ldaphost", KW_LDAPHOST}, + {"righthostaccess", KW_RIGHTHOSTACCESS}, {"leftid", KW_LEFTID}, + {"strictcrlpolicy", KW_STRICTCRLPOLICY}, {"dumpdir", KW_DUMPDIR}, - {"ldapbase", KW_LDAPBASE}, - {""}, {""}, - {"keyingtries", KW_KEYINGTRIES}, - {""}, {""}, - {"me_peerid", KW_ME_PEERID}, - {""}, - {"leftca", KW_LEFTCA}, - {""}, - {"eap", KW_EAP}, - {""}, {""}, - {"charonstart", KW_CHARONSTART}, - {""}, {""}, - {"pkcs11initargs", KW_PKCS11INITARGS}, - {"interfaces", KW_INTERFACES}, - {""}, {""}, - {"pfs", KW_PFS}, + {"ike", KW_IKE}, + {"leftid2", KW_LEFTID2}, {"postpluto", KW_POSTPLUTO}, - {"klipsdebug", KW_KLIPSDEBUG}, - {""}, - {"hidetos", KW_HIDETOS}, - {""}, {""}, - {"modeconfig", KW_MODECONFIG}, - {"cacert", KW_CACERT}, - {""}, - {"ldaphost", KW_LDAPHOST}, + {"rightupdown", KW_RIGHTUPDOWN}, + {"plutostderrlog", KW_PLUTOSTDERRLOG}, + {"pfs", KW_PFS}, + {"fragicmp", KW_FRAGICMP}, + {"overridemtu", KW_OVERRIDEMTU}, + {"leftauth2", KW_LEFTAUTH2}, {"uniqueids", KW_UNIQUEIDS}, + {"prepluto", KW_PREPLUTO}, + {"leftsubnetwithin", KW_LEFTSUBNETWITHIN}, + {"keyexchange", KW_KEYEXCHANGE}, + {"keep_alive", KW_KEEP_ALIVE}, + {"hidetos", KW_HIDETOS}, {"force_keepalive", KW_FORCE_KEEPALIVE}, - {""}, {""}, {""}, {""}, - {"dpdtimeout", KW_DPDTIMEOUT}, - {"pkcs11proxy", KW_PKCS11PROXY}, - {""}, {""}, {""}, {""}, - {"charondebug", KW_CHARONDEBUG}, - {""}, {"installpolicy", KW_INSTALLPOLICY}, - {"cachecrls", KW_CACHECRLS}, - {""}, {""}, {""}, - {"packetdefault", KW_PACKETDEFAULT}, - {""}, - {"strictcrlpolicy", KW_STRICTCRLPOLICY}, - {""}, {""}, {""}, {""}, {""}, {""}, {""}, {""}, - {"also", KW_ALSO}, - {""}, {""}, {""}, {""}, - {"auto", KW_AUTO}, - {""}, {""}, {""}, {""}, {""}, {""}, + {"dpdaction", KW_DPDACTION}, + {"eap_identity", KW_EAP_IDENTITY}, {"forceencaps", KW_FORCEENCAPS}, - {""}, + {"nocrsend", KW_NOCRSEND}, + {"auth", KW_AUTH}, + {"leftauth", KW_LEFTAUTH}, + {"mobike", KW_MOBIKE}, + {"plutodebug", KW_PLUTODEBUG}, + {"charonstart", KW_CHARONSTART}, + {"interfaces", KW_INTERFACES}, + {"pkcs11module", KW_PKCS11MODULE}, {"dpddelay", KW_DPDDELAY}, - {""}, {""}, {""}, - {"eap_identity", KW_EAP_IDENTITY}, - {""}, - {"dpdaction", KW_DPDACTION}, - {"xauth", KW_XAUTH}, + {"pkcs11keepstate", KW_PKCS11KEEPSTATE}, + {"reauth", KW_REAUTH}, + {"me_peerid", KW_ME_PEERID}, + {"rekeymargin", KW_REKEYMARGIN}, + {"pkcs11initargs", KW_PKCS11INITARGS}, + {"mediation", KW_MEDIATION}, + {"pfsgroup", KW_PFSGROUP}, + {"mediated_by", KW_MEDIATED_BY}, + {"keyingtries", KW_KEYINGTRIES}, + {"dpdtimeout", KW_DPDTIMEOUT}, + {"keylife", KW_KEYLIFE}, + {"charondebug", KW_CHARONDEBUG}, + {"ikelifetime", KW_IKELIFETIME}, {"authby", KW_AUTHBY}, - {""}, {""}, {""}, {""}, {""}, {""}, - {"nat_traversal", KW_NAT_TRAVERSAL}, - {""}, {""}, {""}, {""}, {""}, - {"auth", KW_AUTH}, - {""}, {""}, {""}, {""}, {""}, {""}, {""}, {""}, {""}, - {""}, {""}, {""}, {""}, {""}, {""}, {""}, {""}, {""}, - {""}, {""}, {""}, {""}, {""}, {""}, {""}, {""}, {""}, - {""}, - {"nocrsend", KW_NOCRSEND} + {"pkcs11proxy", KW_PKCS11PROXY}, + {"klipsdebug", KW_KLIPSDEBUG}, + {"modeconfig", KW_MODECONFIG} + }; + +static const short lookup[] = + { + -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + -1, -1, -1, 0, 1, -1, 2, 3, -1, 4, + -1, 5, 6, 7, 8, 9, 10, 11, 12, 13, + 14, 15, 16, -1, 17, 18, -1, -1, 19, 20, + 21, -1, -1, 22, 23, 24, 25, 26, 27, 28, + -1, -1, 29, 30, 31, 32, 33, 34, 35, 36, + 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, + 47, 48, 49, -1, 50, -1, 51, 52, 53, 54, + 55, -1, 56, 57, 58, -1, 59, 60, 61, 62, + 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, + 73, 74, -1, 75, 76, 77, 78, -1, -1, 79, + 80, 81, 82, -1, 83, 84, 85, 86, -1, 87, + 88, 89, 90, 91, 92, 93, -1, 94, 95, -1, + -1, -1, 96, 97, -1, 98, 99, -1, 100, -1, + -1, -1, -1, -1, 101, -1, -1, -1, -1, -1, + -1, -1, -1, -1, -1, 102, -1, 103, -1, 104, + -1, 105, -1, -1, 106, 107, -1, 108, -1, -1, + -1, -1, -1, -1, -1, -1, -1, 109, -1, -1, + -1, -1, -1, -1, -1, -1, -1, -1, -1, 110, + -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, + 111 }; #ifdef __GNUC__ @@ -288,10 +280,15 @@ in_word_set (str, len) if (key <= MAX_HASH_VALUE && key >= 0) { - register const char *s = wordlist[key].name; + register int index = lookup[key]; + + if (index >= 0) + { + register const char *s = wordlist[index].name; - if (*str == *s && !strcmp (str + 1, s + 1)) - return &wordlist[key]; + if (*str == *s && !strcmp (str + 1, s + 1)) + return &wordlist[index]; + } } } return 0; diff --git a/src/starter/keywords.h b/src/starter/keywords.h index 756c33075..ae9a6d15f 100644 --- a/src/starter/keywords.h +++ b/src/starter/keywords.h @@ -11,177 +11,185 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: keywords.h 4612 2008-11-11 06:37:37Z andreas $ */ #ifndef _KEYWORDS_H_ #define _KEYWORDS_H_ typedef enum { - /* config setup keywords */ - KW_INTERFACES, - KW_DUMPDIR, - KW_CHARONSTART, - KW_PLUTOSTART, - - /* pluto/charon keywords */ - KW_PLUTODEBUG, - KW_CHARONDEBUG, - KW_PREPLUTO, - KW_POSTPLUTO, - KW_PLUTOSTDERRLOG, - KW_UNIQUEIDS, - KW_OVERRIDEMTU, - KW_CRLCHECKINTERVAL, - KW_CACHECRLS, - KW_STRICTCRLPOLICY, - KW_NOCRSEND, - KW_NAT_TRAVERSAL, - KW_KEEP_ALIVE, - KW_FORCE_KEEPALIVE, - KW_VIRTUAL_PRIVATE, - KW_PKCS11MODULE, - KW_PKCS11INITARGS, - KW_PKCS11KEEPSTATE, - KW_PKCS11PROXY, - -#define KW_PLUTO_FIRST KW_PLUTODEBUG -#define KW_PLUTO_LAST KW_PKCS11PROXY - - /* KLIPS keywords */ - KW_KLIPSDEBUG, - KW_FRAGICMP, - KW_PACKETDEFAULT, - KW_HIDETOS, - -#define KW_KLIPS_FIRST KW_KLIPSDEBUG -#define KW_KLIPS_LAST KW_HIDETOS - -#define KW_SETUP_FIRST KW_INTERFACES -#define KW_SETUP_LAST KW_HIDETOS - - /* conn section keywords */ - KW_CONN_NAME, - KW_CONN_SETUP, - KW_KEYEXCHANGE, - KW_TYPE, - KW_PFS, - KW_COMPRESS, - KW_INSTALLPOLICY, - KW_AUTH, - KW_AUTHBY, - KW_EAP, - KW_EAP_IDENTITY, - KW_MOBIKE, - KW_FORCEENCAPS, - KW_IKELIFETIME, - KW_KEYLIFE, - KW_REKEYMARGIN, - KW_KEYINGTRIES, - KW_REKEYFUZZ, - KW_REKEY, - KW_REAUTH, - KW_IKE, - KW_ESP, - KW_PFSGROUP, - KW_DPDDELAY, - KW_DPDTIMEOUT, - KW_DPDACTION, - KW_MODECONFIG, - KW_XAUTH, - KW_MEDIATION, - KW_MEDIATED_BY, - KW_ME_PEERID, - -#define KW_CONN_FIRST KW_CONN_SETUP -#define KW_CONN_LAST KW_ME_PEERID + /* config setup keywords */ + KW_INTERFACES, + KW_DUMPDIR, + KW_CHARONSTART, + KW_PLUTOSTART, + + /* pluto/charon keywords */ + KW_PLUTODEBUG, + KW_CHARONDEBUG, + KW_PREPLUTO, + KW_POSTPLUTO, + KW_PLUTOSTDERRLOG, + KW_UNIQUEIDS, + KW_OVERRIDEMTU, + KW_CRLCHECKINTERVAL, + KW_CACHECRLS, + KW_STRICTCRLPOLICY, + KW_NOCRSEND, + KW_NAT_TRAVERSAL, + KW_KEEP_ALIVE, + KW_FORCE_KEEPALIVE, + KW_VIRTUAL_PRIVATE, + KW_PKCS11MODULE, + KW_PKCS11INITARGS, + KW_PKCS11KEEPSTATE, + KW_PKCS11PROXY, + +#define KW_PLUTO_FIRST KW_PLUTODEBUG +#define KW_PLUTO_LAST KW_PKCS11PROXY + + /* KLIPS keywords */ + KW_KLIPSDEBUG, + KW_FRAGICMP, + KW_PACKETDEFAULT, + KW_HIDETOS, + +#define KW_KLIPS_FIRST KW_KLIPSDEBUG +#define KW_KLIPS_LAST KW_HIDETOS + +#define KW_SETUP_FIRST KW_INTERFACES +#define KW_SETUP_LAST KW_HIDETOS + + /* conn section keywords */ + KW_CONN_NAME, + KW_CONN_SETUP, + KW_KEYEXCHANGE, + KW_TYPE, + KW_PFS, + KW_COMPRESS, + KW_INSTALLPOLICY, + KW_AUTH, + KW_AUTHBY, + KW_EAP, + KW_EAP_IDENTITY, + KW_MOBIKE, + KW_FORCEENCAPS, + KW_IKELIFETIME, + KW_KEYLIFE, + KW_REKEYMARGIN, + KW_KEYINGTRIES, + KW_REKEYFUZZ, + KW_REKEY, + KW_REAUTH, + KW_IKE, + KW_ESP, + KW_PFSGROUP, + KW_DPDDELAY, + KW_DPDTIMEOUT, + KW_DPDACTION, + KW_MODECONFIG, + KW_XAUTH, + KW_MEDIATION, + KW_MEDIATED_BY, + KW_ME_PEERID, + +#define KW_CONN_FIRST KW_CONN_SETUP +#define KW_CONN_LAST KW_ME_PEERID /* ca section keywords */ - KW_CA_NAME, - KW_CA_SETUP, - KW_CACERT, - KW_LDAPHOST, - KW_LDAPBASE, - KW_CRLURI, - KW_CRLURI2, - KW_OCSPURI, - KW_OCSPURI2, - KW_CERTURIBASE, - -#define KW_CA_FIRST KW_CA_SETUP -#define KW_CA_LAST KW_CERTURIBASE + KW_CA_NAME, + KW_CA_SETUP, + KW_CACERT, + KW_LDAPHOST, + KW_LDAPBASE, + KW_CRLURI, + KW_CRLURI2, + KW_OCSPURI, + KW_OCSPURI2, + KW_CERTURIBASE, + +#define KW_CA_FIRST KW_CA_SETUP +#define KW_CA_LAST KW_CERTURIBASE /* end keywords */ - KW_HOST, - KW_NEXTHOP, - KW_SUBNET, - KW_SUBNETWITHIN, - KW_PROTOPORT, - KW_SOURCEIP, - KW_NATIP, - KW_FIREWALL, - KW_HOSTACCESS, - KW_ALLOWANY, - KW_UPDOWN, - KW_ID, - KW_RSASIGKEY, - KW_CERT, - KW_SENDCERT, - KW_CA, - KW_GROUPS, - KW_IFACE, - -#define KW_END_FIRST KW_HOST -#define KW_END_LAST KW_IFACE + KW_HOST, + KW_NEXTHOP, + KW_SUBNET, + KW_SUBNETWITHIN, + KW_PROTOPORT, + KW_SOURCEIP, + KW_NATIP, + KW_FIREWALL, + KW_HOSTACCESS, + KW_ALLOWANY, + KW_UPDOWN, + KW_ID, + KW_RSASIGKEY, + KW_CERT, + KW_SENDCERT, + KW_CA, + KW_GROUPS, + KW_IFACE, + +#define KW_END_FIRST KW_HOST +#define KW_END_LAST KW_IFACE /* left end keywords */ - KW_LEFT, - KW_LEFTNEXTHOP, - KW_LEFTSUBNET, - KW_LEFTSUBNETWITHIN, - KW_LEFTPROTOPORT, - KW_LEFTSOURCEIP, - KW_LEFTNATIP, - KW_LEFTFIREWALL, - KW_LEFTHOSTACCESS, - KW_LEFTALLOWANY, - KW_LEFTUPDOWN, - KW_LEFTID, - KW_LEFTRSASIGKEY, - KW_LEFTCERT, - KW_LEFTSENDCERT, - KW_LEFTCA, - KW_LEFTGROUPS, - -#define KW_LEFT_FIRST KW_LEFT -#define KW_LEFT_LAST KW_LEFTGROUPS + KW_LEFT, + KW_LEFTNEXTHOP, + KW_LEFTSUBNET, + KW_LEFTSUBNETWITHIN, + KW_LEFTPROTOPORT, + KW_LEFTSOURCEIP, + KW_LEFTNATIP, + KW_LEFTFIREWALL, + KW_LEFTHOSTACCESS, + KW_LEFTALLOWANY, + KW_LEFTUPDOWN, + KW_LEFTAUTH, + KW_LEFTAUTH2, + KW_LEFTID, + KW_LEFTID2, + KW_LEFTRSASIGKEY, + KW_LEFTCERT, + KW_LEFTCERT2, + KW_LEFTSENDCERT, + KW_LEFTCA, + KW_LEFTCA2, + KW_LEFTGROUPS, + +#define KW_LEFT_FIRST KW_LEFT +#define KW_LEFT_LAST KW_LEFTGROUPS /* right end keywords */ - KW_RIGHT, - KW_RIGHTNEXTHOP, - KW_RIGHTSUBNET, - KW_RIGHTSUBNETWITHIN, - KW_RIGHTPROTOPORT, - KW_RIGHTSOURCEIP, - KW_RIGHTNATIP, - KW_RIGHTFIREWALL, - KW_RIGHTHOSTACCESS, - KW_RIGHTALLOWANY, - KW_RIGHTUPDOWN, - KW_RIGHTID, - KW_RIGHTRSASIGKEY, - KW_RIGHTCERT, - KW_RIGHTSENDCERT, - KW_RIGHTCA, - KW_RIGHTGROUPS, - -#define KW_RIGHT_FIRST KW_RIGHT -#define KW_RIGHT_LAST KW_RIGHTGROUPS - - /* general section keywords */ - KW_ALSO, - KW_AUTO + KW_RIGHT, + KW_RIGHTNEXTHOP, + KW_RIGHTSUBNET, + KW_RIGHTSUBNETWITHIN, + KW_RIGHTPROTOPORT, + KW_RIGHTSOURCEIP, + KW_RIGHTNATIP, + KW_RIGHTFIREWALL, + KW_RIGHTHOSTACCESS, + KW_RIGHTALLOWANY, + KW_RIGHTUPDOWN, + KW_RIGHTAUTH, + KW_RIGHTAUTH2, + KW_RIGHTID, + KW_RIGHTID2, + KW_RIGHTRSASIGKEY, + KW_RIGHTCERT, + KW_RIGHTCERT2, + KW_RIGHTSENDCERT, + KW_RIGHTCA, + KW_RIGHTCA2, + KW_RIGHTGROUPS, + +#define KW_RIGHT_FIRST KW_RIGHT +#define KW_RIGHT_LAST KW_RIGHTGROUPS + + /* general section keywords */ + KW_ALSO, + KW_AUTO } kw_token_t; diff --git a/src/starter/keywords.txt b/src/starter/keywords.txt index 8dfa03325..66c894850 100644 --- a/src/starter/keywords.txt +++ b/src/starter/keywords.txt @@ -12,8 +12,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: keywords.txt 4612 2008-11-11 06:37:37Z andreas $ */ #include <string.h> @@ -104,10 +102,15 @@ lefthostaccess, KW_LEFTHOSTACCESS leftallowany, KW_LEFTALLOWANY leftupdown, KW_LEFTUPDOWN leftid, KW_LEFTID +leftid2, KW_LEFTID2 +leftauth, KW_LEFTAUTH +leftauth2, KW_LEFTAUTH2 leftrsasigkey, KW_LEFTRSASIGKEY leftcert, KW_LEFTCERT, +leftcert2, KW_LEFTCERT2, leftsendcert, KW_LEFTSENDCERT leftca, KW_LEFTCA +leftca2, KW_LEFTCA2 leftgroups, KW_LEFTGROUPS right, KW_RIGHT rightnexthop, KW_RIGHTNEXTHOP @@ -121,10 +124,15 @@ righthostaccess, KW_RIGHTHOSTACCESS rightallowany, KW_RIGHTALLOWANY rightupdown, KW_RIGHTUPDOWN rightid, KW_RIGHTID +rightid2, KW_RIGHTID2 +rightauth, KW_RIGHTAUTH +rightauth2, KW_RIGHTAUTH2 rightrsasigkey, KW_RIGHTRSASIGKEY rightcert, KW_RIGHTCERT +rightcert2, KW_RIGHTCERT2 rightsendcert, KW_RIGHTSENDCERT rightca, KW_RIGHTCA +rightca2, KW_RIGHTCA2 rightgroups, KW_RIGHTGROUPS also, KW_ALSO auto, KW_AUTO diff --git a/src/starter/klips.c b/src/starter/klips.c index 5c8164419..061dee50c 100644 --- a/src/starter/klips.c +++ b/src/starter/klips.c @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: klips.c 4632 2008-11-11 18:37:19Z martin $ */ #include <sys/types.h> @@ -29,54 +27,54 @@ bool starter_klips_init(void) { - struct stat stb; - - if (stat(PROC_KLIPS, &stb) != 0) - { - /* ipsec module makes the pf_key proc interface visible */ - if (stat(PROC_MODULES, &stb) == 0) - { - ignore_result(system("modprobe -qv ipsec")); - } + struct stat stb; - /* now test again */ if (stat(PROC_KLIPS, &stb) != 0) { - DBG(DBG_CONTROL, - DBG_log("kernel appears to lack the KLIPS IPsec stack") - ) - return FALSE; + /* ipsec module makes the pf_key proc interface visible */ + if (stat(PROC_MODULES, &stb) == 0) + { + ignore_result(system("modprobe -qv ipsec")); + } + + /* now test again */ + if (stat(PROC_KLIPS, &stb) != 0) + { + DBG(DBG_CONTROL, + DBG_log("kernel appears to lack the KLIPS IPsec stack") + ) + return FALSE; + } } - } - - /* load crypto algorithm modules */ - ignore_result(system("modprobe -qv ipsec_aes")); - ignore_result(system("modprobe -qv ipsec_blowfish")); - ignore_result(system("modprobe -qv ipsec_sha2")); + + /* load crypto algorithm modules */ + ignore_result(system("modprobe -qv ipsec_aes")); + ignore_result(system("modprobe -qv ipsec_blowfish")); + ignore_result(system("modprobe -qv ipsec_sha2")); - DBG(DBG_CONTROL, - DBG_log("Found KLIPS IPsec stack") - ) - - return TRUE; + DBG(DBG_CONTROL, + DBG_log("Found KLIPS IPsec stack") + ) + + return TRUE; } void starter_klips_cleanup(void) { - if (system("type eroute > /dev/null 2>&1") == 0) - { - ignore_result(system("spi --clear")); - ignore_result(system("eroute --clear")); - } - else if (system("type setkey > /dev/null 2>&1") == 0) - { - ignore_result(system("setkey -F")); - ignore_result(system("setkey -FP")); - } - else - { - plog("WARNING: cannot flush IPsec state/policy database"); - } + if (system("type eroute > /dev/null 2>&1") == 0) + { + ignore_result(system("spi --clear")); + ignore_result(system("eroute --clear")); + } + else if (system("type setkey > /dev/null 2>&1") == 0) + { + ignore_result(system("setkey -F")); + ignore_result(system("setkey -FP")); + } + else + { + plog("WARNING: cannot flush IPsec state/policy database"); + } } diff --git a/src/starter/klips.h b/src/starter/klips.h index 60055b4f1..e93348df1 100644 --- a/src/starter/klips.h +++ b/src/starter/klips.h @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: klips.h 4618 2008-11-11 09:22:00Z tobias $ */ #ifndef _STARTER_KLIPS_H_ diff --git a/src/starter/loglite.c b/src/starter/loglite.c index 94d9b79bb..415cf931c 100644 --- a/src/starter/loglite.c +++ b/src/starter/loglite.c @@ -11,8 +11,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: loglite.c 3267 2007-10-08 19:57:54Z andreas $ */ #include <stdio.h> @@ -23,7 +21,7 @@ #include <errno.h> #include <string.h> #include <unistd.h> -#include <signal.h> /* used only if MSG_NOSIGNAL not defined */ +#include <signal.h> /* used only if MSG_NOSIGNAL not defined */ #include <libgen.h> #include <sys/stat.h> #include <sys/types.h> @@ -36,118 +34,118 @@ #include <whack.h> bool - log_to_stderr = FALSE, /* should log go to stderr? */ - log_to_syslog = TRUE; /* should log go to syslog? */ + log_to_stderr = FALSE, /* should log go to stderr? */ + log_to_syslog = TRUE; /* should log go to syslog? */ void init_log(const char *program) { - if (log_to_stderr) - setbuf(stderr, NULL); - if (log_to_syslog) - openlog(program, LOG_CONS | LOG_NDELAY | LOG_PID, LOG_AUTHPRIV); + if (log_to_stderr) + setbuf(stderr, NULL); + if (log_to_syslog) + openlog(program, LOG_CONS | LOG_NDELAY | LOG_PID, LOG_AUTHPRIV); } void close_log(void) { - if (log_to_syslog) - closelog(); + if (log_to_syslog) + closelog(); } void plog(const char *message, ...) { - va_list args; - char m[LOG_WIDTH]; /* longer messages will be truncated */ + va_list args; + char m[LOG_WIDTH]; /* longer messages will be truncated */ - va_start(args, message); - vsnprintf(m, sizeof(m), message, args); - va_end(args); + va_start(args, message); + vsnprintf(m, sizeof(m), message, args); + va_end(args); - if (log_to_stderr) - fprintf(stderr, "%s\n", m); - if (log_to_syslog) - syslog(LOG_WARNING, "%s", m); + if (log_to_stderr) + fprintf(stderr, "%s\n", m); + if (log_to_syslog) + syslog(LOG_WARNING, "%s", m); } void loglog(int mess_no, const char *message, ...) { - va_list args; - char m[LOG_WIDTH]; /* longer messages will be truncated */ + va_list args; + char m[LOG_WIDTH]; /* longer messages will be truncated */ - va_start(args, message); - vsnprintf(m, sizeof(m), message, args); - va_end(args); + va_start(args, message); + vsnprintf(m, sizeof(m), message, args); + va_end(args); - if (log_to_stderr) - fprintf(stderr, "%s\n", m); - if (log_to_syslog) - syslog(LOG_WARNING, "%s", m); + if (log_to_stderr) + fprintf(stderr, "%s\n", m); + if (log_to_syslog) + syslog(LOG_WARNING, "%s", m); } void log_errno_routine(int e, const char *message, ...) { - va_list args; - char m[LOG_WIDTH]; /* longer messages will be truncated */ + va_list args; + char m[LOG_WIDTH]; /* longer messages will be truncated */ - va_start(args, message); - vsnprintf(m, sizeof(m), message, args); - va_end(args); + va_start(args, message); + vsnprintf(m, sizeof(m), message, args); + va_end(args); - if (log_to_stderr) - fprintf(stderr, "ERROR: %s. Errno %d: %s\n", m, e, strerror(e)); - if (log_to_syslog) - syslog(LOG_ERR, "ERROR: %s. Errno %d: %s", m, e, strerror(e)); + if (log_to_stderr) + fprintf(stderr, "ERROR: %s. Errno %d: %s\n", m, e, strerror(e)); + if (log_to_syslog) + syslog(LOG_ERR, "ERROR: %s. Errno %d: %s", m, e, strerror(e)); } void exit_log(const char *message, ...) { - va_list args; - char m[LOG_WIDTH]; /* longer messages will be truncated */ - - va_start(args, message); - vsnprintf(m, sizeof(m), message, args); - va_end(args); - - if (log_to_stderr) - fprintf(stderr, "FATAL ERROR: %s\n", m); - if (log_to_syslog) - syslog(LOG_ERR, "FATAL ERROR: %s", m); - exit(1); + va_list args; + char m[LOG_WIDTH]; /* longer messages will be truncated */ + + va_start(args, message); + vsnprintf(m, sizeof(m), message, args); + va_end(args); + + if (log_to_stderr) + fprintf(stderr, "FATAL ERROR: %s\n", m); + if (log_to_syslog) + syslog(LOG_ERR, "FATAL ERROR: %s", m); + exit(1); } void exit_log_errno_routine(int e, const char *message, ...) { - va_list args; - char m[LOG_WIDTH]; /* longer messages will be truncated */ - - va_start(args, message); - vsnprintf(m, sizeof(m), message, args); - va_end(args); - - if (log_to_stderr) - fprintf(stderr, "FATAL ERROR: %s. Errno %d: %s\n", m, e, strerror(e)); - if (log_to_syslog) - syslog(LOG_ERR, "FATAL ERROR: %s. Errno %d: %s", m, e, strerror(e)); - exit(1); + va_list args; + char m[LOG_WIDTH]; /* longer messages will be truncated */ + + va_start(args, message); + vsnprintf(m, sizeof(m), message, args); + va_end(args); + + if (log_to_stderr) + fprintf(stderr, "FATAL ERROR: %s. Errno %d: %s\n", m, e, strerror(e)); + if (log_to_syslog) + syslog(LOG_ERR, "FATAL ERROR: %s. Errno %d: %s", m, e, strerror(e)); + exit(1); } void whack_log(int mess_no, const char *message, ...) { - va_list args; - char m[LOG_WIDTH]; /* longer messages will be truncated */ + va_list args; + char m[LOG_WIDTH]; /* longer messages will be truncated */ - va_start(args, message); - vsnprintf(m, sizeof(m), message, args); - va_end(args); + va_start(args, message); + vsnprintf(m, sizeof(m), message, args); + va_end(args); - fprintf(stderr, "%s\n", m); + fprintf(stderr, "%s\n", m); } /* Build up a diagnostic in a static buffer. @@ -165,16 +163,16 @@ char diag_space[sizeof(diag_space)]; err_t builddiag(const char *fmt, ...) { - static char diag_space[LOG_WIDTH]; /* longer messages will be truncated */ - char t[sizeof(diag_space)]; /* build result here first */ - va_list args; - - va_start(args, fmt); - t[0] = '\0'; /* in case nothing terminates string */ - vsnprintf(t, sizeof(t), fmt, args); - va_end(args); - strcpy(diag_space, t); - return diag_space; + static char diag_space[LOG_WIDTH]; /* longer messages will be truncated */ + char t[sizeof(diag_space)]; /* build result here first */ + va_list args; + + va_start(args, fmt); + t[0] = '\0'; /* in case nothing terminates string */ + vsnprintf(t, sizeof(t), fmt, args); + va_end(args); + strcpy(diag_space, t); + return diag_space; } /* Debugging message support */ @@ -184,29 +182,29 @@ builddiag(const char *fmt, ...) void switch_fail(int n, const char *file_str, unsigned long line_no) { - char buf[30]; + char buf[30]; - snprintf(buf, sizeof(buf), "case %d unexpected", n); - passert_fail(buf, file_str, line_no); + snprintf(buf, sizeof(buf), "case %d unexpected", n); + passert_fail(buf, file_str, line_no); } void passert_fail(const char *pred_str, const char *file_str, unsigned long line_no) { - /* we will get a possibly unplanned prefix. Hope it works */ - loglog(RC_LOG_SERIOUS, "ASSERTION FAILED at %s:%lu: %s", file_str, line_no, pred_str); - abort(); /* exiting correctly doesn't always work */ + /* we will get a possibly unplanned prefix. Hope it works */ + loglog(RC_LOG_SERIOUS, "ASSERTION FAILED at %s:%lu: %s", file_str, line_no, pred_str); + abort(); /* exiting correctly doesn't always work */ } lset_t - base_debugging = DBG_NONE, /* default to reporting nothing */ - cur_debugging = DBG_NONE; + base_debugging = DBG_NONE, /* default to reporting nothing */ + cur_debugging = DBG_NONE; void pexpect_log(const char *pred_str, const char *file_str, unsigned long line_no) { - /* we will get a possibly unplanned prefix. Hope it works */ - loglog(RC_LOG_SERIOUS, "EXPECTATION FAILED at %s:%lu: %s", file_str, line_no, pred_str); + /* we will get a possibly unplanned prefix. Hope it works */ + loglog(RC_LOG_SERIOUS, "EXPECTATION FAILED at %s:%lu: %s", file_str, line_no, pred_str); } /* log a debugging message (prefixed by "| ") */ @@ -214,17 +212,17 @@ pexpect_log(const char *pred_str, const char *file_str, unsigned long line_no) void DBG_log(const char *message, ...) { - va_list args; - char m[LOG_WIDTH]; /* longer messages will be truncated */ + va_list args; + char m[LOG_WIDTH]; /* longer messages will be truncated */ - va_start(args, message); - vsnprintf(m, sizeof(m), message, args); - va_end(args); + va_start(args, message); + vsnprintf(m, sizeof(m), message, args); + va_end(args); - if (log_to_stderr) - fprintf(stderr, "| %s\n", m); - if (log_to_syslog) - syslog(LOG_DEBUG, "| %s", m); + if (log_to_stderr) + fprintf(stderr, "| %s\n", m); + if (log_to_syslog) + syslog(LOG_DEBUG, "| %s", m); } /* dump raw bytes in hex to stderr (for lack of any better destination) */ @@ -232,62 +230,62 @@ DBG_log(const char *message, ...) void DBG_dump(const char *label, const void *p, size_t len) { -# define DUMP_LABEL_WIDTH 20 /* arbitrary modest boundary */ -# define DUMP_WIDTH (4 * (1 + 4 * 3) + 1) - char buf[DUMP_LABEL_WIDTH + DUMP_WIDTH]; - char *bp; - const unsigned char *cp = p; +# define DUMP_LABEL_WIDTH 20 /* arbitrary modest boundary */ +# define DUMP_WIDTH (4 * (1 + 4 * 3) + 1) + char buf[DUMP_LABEL_WIDTH + DUMP_WIDTH]; + char *bp; + const unsigned char *cp = p; - bp = buf; - - if (label != NULL && label[0] != '\0') - { - /* Handle the label. Care must be taken to avoid buffer overrun. */ - size_t llen = strlen(label); + bp = buf; - if (llen + 1 > sizeof(buf)) + if (label != NULL && label[0] != '\0') { - DBG_log("%s", label); + /* Handle the label. Care must be taken to avoid buffer overrun. */ + size_t llen = strlen(label); + + if (llen + 1 > sizeof(buf)) + { + DBG_log("%s", label); + } + else + { + strcpy(buf, label); + if (buf[llen-1] == '\n') + { + buf[llen-1] = '\0'; /* get rid of newline */ + DBG_log("%s", buf); + } + else if (llen < DUMP_LABEL_WIDTH) + { + bp = buf + llen; + } + else + { + DBG_log("%s", buf); + } + } } - else - { - strcpy(buf, label); - if (buf[llen-1] == '\n') - { - buf[llen-1] = '\0'; /* get rid of newline */ - DBG_log("%s", buf); - } - else if (llen < DUMP_LABEL_WIDTH) - { - bp = buf + llen; - } - else - { - DBG_log("%s", buf); - } - } - } - do { - int i, j; - - for (i = 0; len!=0 && i!=4; i++) - { - *bp++ = ' '; - for (j = 0; len!=0 && j!=4; len--, j++) - { - static const char hexdig[] = "0123456789abcdef"; - - *bp++ = ' '; - *bp++ = hexdig[(*cp >> 4) & 0xF]; - *bp++ = hexdig[*cp & 0xF]; - cp++; - } - } - *bp = '\0'; - DBG_log("%s", buf); - bp = buf; - } while (len != 0); + do { + int i, j; + + for (i = 0; len!=0 && i!=4; i++) + { + *bp++ = ' '; + for (j = 0; len!=0 && j!=4; len--, j++) + { + static const char hexdig[] = "0123456789abcdef"; + + *bp++ = ' '; + *bp++ = hexdig[(*cp >> 4) & 0xF]; + *bp++ = hexdig[*cp & 0xF]; + cp++; + } + } + *bp = '\0'; + DBG_log("%s", buf); + bp = buf; + } while (len != 0); # undef DUMP_LABEL_WIDTH # undef DUMP_WIDTH } diff --git a/src/starter/netkey.c b/src/starter/netkey.c index 1490abf29..e0449f0b2 100644 --- a/src/starter/netkey.c +++ b/src/starter/netkey.c @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: netkey.c 4632 2008-11-11 18:37:19Z martin $ */ #include <sys/types.h> @@ -29,57 +27,57 @@ bool starter_netkey_init(void) { - struct stat stb; + struct stat stb; - if (stat(PROC_NETKEY, &stb) != 0) - { - /* af_key module makes the netkey proc interface visible */ - if (stat(PROC_MODULES, &stb) == 0) + if (stat(PROC_NETKEY, &stb) != 0) { - ignore_result(system("modprobe -qv af_key")); + /* af_key module makes the netkey proc interface visible */ + if (stat(PROC_MODULES, &stb) == 0) + { + ignore_result(system("modprobe -qv af_key")); + } + + /* now test again */ + if (stat(PROC_NETKEY, &stb) != 0) + { + DBG(DBG_CONTROL, + DBG_log("kernel appears to lack the native netkey IPsec stack") + ) + return FALSE; + } } - /* now test again */ - if (stat(PROC_NETKEY, &stb) != 0) + /* make sure that all required IPsec modules are loaded */ + if (stat(PROC_MODULES, &stb) == 0) { - DBG(DBG_CONTROL, - DBG_log("kernel appears to lack the native netkey IPsec stack") - ) - return FALSE; + ignore_result(system("modprobe -qv ah4")); + ignore_result(system("modprobe -qv esp4")); + ignore_result(system("modprobe -qv ipcomp")); + ignore_result(system("modprobe -qv xfrm4_tunnel")); + ignore_result(system("modprobe -qv xfrm_user")); } - } - - /* make sure that all required IPsec modules are loaded */ - if (stat(PROC_MODULES, &stb) == 0) - { - ignore_result(system("modprobe -qv ah4")); - ignore_result(system("modprobe -qv esp4")); - ignore_result(system("modprobe -qv ipcomp")); - ignore_result(system("modprobe -qv xfrm4_tunnel")); - ignore_result(system("modprobe -qv xfrm_user")); - } - DBG(DBG_CONTROL, - DBG_log("Found netkey IPsec stack") - ) - return TRUE; + DBG(DBG_CONTROL, + DBG_log("Found netkey IPsec stack") + ) + return TRUE; } void starter_netkey_cleanup(void) { - if (system("ip xfrm state > /dev/null 2>&1") == 0) - { - ignore_result(system("ip xfrm state flush")); - ignore_result(system("ip xfrm policy flush")); - } - else if (system("type setkey > /dev/null 2>&1") == 0) - { - ignore_result(system("setkey -F")); - ignore_result(system("setkey -FP")); - } - else - { - plog("WARNING: cannot flush IPsec state/policy database"); - } + if (system("ip xfrm state > /dev/null 2>&1") == 0) + { + ignore_result(system("ip xfrm state flush")); + ignore_result(system("ip xfrm policy flush")); + } + else if (system("type setkey > /dev/null 2>&1") == 0) + { + ignore_result(system("setkey -F")); + ignore_result(system("setkey -FP")); + } + else + { + plog("WARNING: cannot flush IPsec state/policy database"); + } } diff --git a/src/starter/netkey.h b/src/starter/netkey.h index dc9cacbf8..55f6a7c47 100644 --- a/src/starter/netkey.h +++ b/src/starter/netkey.h @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: netkey.h 3267 2007-10-08 19:57:54Z andreas $ */ #ifndef _STARTER_NETKEY_H_ diff --git a/src/starter/parser.h b/src/starter/parser.h index 3af20b60e..1c6cf20ef 100644 --- a/src/starter/parser.h +++ b/src/starter/parser.h @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: parser.h 3267 2007-10-08 19:57:54Z andreas $ */ #ifndef _IPSEC_PARSER_H_ @@ -22,32 +20,32 @@ typedef struct kw_entry kw_entry_t; struct kw_entry { - char *name; - kw_token_t token; + char *name; + kw_token_t token; }; typedef struct kw_list kw_list_t; struct kw_list { - kw_entry_t *entry; - char *value; - kw_list_t *next; + kw_entry_t *entry; + char *value; + kw_list_t *next; }; typedef struct section_list section_list_t; struct section_list { - char *name; - kw_list_t *kw; - section_list_t *next; + char *name; + kw_list_t *kw; + section_list_t *next; }; typedef struct config_parsed config_parsed_t; struct config_parsed { - kw_list_t *config_setup; - section_list_t *conn_first, *conn_last; - section_list_t *ca_first, *ca_last; + kw_list_t *config_setup; + section_list_t *conn_first, *conn_last; + section_list_t *ca_first, *ca_last; }; config_parsed_t *parser_load_conf (const char *file); diff --git a/src/starter/parser.l b/src/starter/parser.l index e51d655df..5857c0815 100644 --- a/src/starter/parser.l +++ b/src/starter/parser.l @@ -1,3 +1,5 @@ +%option noinput +%option nounput %{ /* FreeS/WAN config file parser (parser.l) * Copyright (C) 2001 Mathieu Lafon - Arkoon Network Security @@ -11,8 +13,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: parser.l 4632 2008-11-11 18:37:19Z martin $ */ #include <string.h> @@ -23,8 +23,6 @@ #define MAX_INCLUDE_DEPTH 20 -#define YY_NO_INPUT -#define YY_NO_UNPUT extern void yyerror(const char *); extern int yylex (void); @@ -43,149 +41,149 @@ int _parser_y_include (const char *filename); void _parser_y_error(char *b, int size, const char *s) { - extern char *yytext; // was: char yytext[]; + extern char *yytext; // was: char yytext[]; - snprintf(b, size, "%s:%d: %s [%s]", - __parser_y_private.filename[__parser_y_private.stack_ptr], - __parser_y_private.line[__parser_y_private.stack_ptr], - s, yytext); + snprintf(b, size, "%s:%d: %s [%s]", + __parser_y_private.filename[__parser_y_private.stack_ptr], + __parser_y_private.line[__parser_y_private.stack_ptr], + s, yytext); } void _parser_y_init (const char *f) { - memset(&__parser_y_private, 0, sizeof(__parser_y_private)); - __parser_y_private.line[0] = 1; - __parser_y_private.filename[0] = strdup(f); + memset(&__parser_y_private, 0, sizeof(__parser_y_private)); + __parser_y_private.line[0] = 1; + __parser_y_private.filename[0] = strdup(f); } void _parser_y_fini (void) { - unsigned int i; - - for (i = 0; i < MAX_INCLUDE_DEPTH; i++) - { - if (__parser_y_private.filename[i]) - free(__parser_y_private.filename[i]); - if (__parser_y_private.file[i]) - fclose(__parser_y_private.file[i]); - } - memset(&__parser_y_private, 0, sizeof(__parser_y_private)); -} - -int _parser_y_include (const char *filename) -{ - glob_t files; - int i, ret; - - ret = glob(filename, GLOB_ERR, NULL, &files); - if (ret) - { - const char *err; + unsigned int i; - switch (ret) + for (i = 0; i < MAX_INCLUDE_DEPTH; i++) { - case GLOB_NOSPACE: - err = "include files ran out of memory"; - break; - case GLOB_ABORTED: - err = "include files aborted due to read error"; - break; - case GLOB_NOMATCH: - err = "include files found no matches"; - break; - default: - err = "unknown include files error"; + if (__parser_y_private.filename[i]) + free(__parser_y_private.filename[i]); + if (__parser_y_private.file[i]) + fclose(__parser_y_private.file[i]); } - yyerror(err); - return 1; - } + memset(&__parser_y_private, 0, sizeof(__parser_y_private)); +} - for (i = 0; i < files.gl_pathc; i++) - { - FILE *f; - unsigned int p = __parser_y_private.stack_ptr + 1; +int _parser_y_include (const char *filename) +{ + glob_t files; + int i, ret; - if (p >= MAX_INCLUDE_DEPTH) + ret = glob(filename, GLOB_ERR, NULL, &files); + if (ret) { - yyerror("max inclusion depth reached"); - return 1; + const char *err; + + switch (ret) + { + case GLOB_NOSPACE: + err = "include files ran out of memory"; + break; + case GLOB_ABORTED: + err = "include files aborted due to read error"; + break; + case GLOB_NOMATCH: + err = "include files found no matches"; + break; + default: + err = "unknown include files error"; + } + yyerror(err); + return 1; } - f = fopen(files.gl_pathv[i], "r"); - if (!f) + for (i = 0; i < files.gl_pathc; i++) { - yyerror("can't open include filename"); - continue; + FILE *f; + unsigned int p = __parser_y_private.stack_ptr + 1; + + if (p >= MAX_INCLUDE_DEPTH) + { + yyerror("max inclusion depth reached"); + return 1; + } + + f = fopen(files.gl_pathv[i], "r"); + if (!f) + { + yyerror("can't open include filename"); + continue; + } + + __parser_y_private.stack_ptr++; + __parser_y_private.file[p] = f; + __parser_y_private.stack[p] = YY_CURRENT_BUFFER; + __parser_y_private.line[p] = 1; + __parser_y_private.filename[p] = strdup(files.gl_pathv[i]); + + yy_switch_to_buffer(yy_create_buffer(f, YY_BUF_SIZE)); } - - __parser_y_private.stack_ptr++; - __parser_y_private.file[p] = f; - __parser_y_private.stack[p] = YY_CURRENT_BUFFER; - __parser_y_private.line[p] = 1; - __parser_y_private.filename[p] = strdup(files.gl_pathv[i]); - - yy_switch_to_buffer(yy_create_buffer(f, YY_BUF_SIZE)); - } - globfree(&files); - return 0; + globfree(&files); + return 0; } %} %% -<<EOF>> { - if (__parser_y_private.filename[__parser_y_private.stack_ptr]) { - free(__parser_y_private.filename[__parser_y_private.stack_ptr]); - __parser_y_private.filename[__parser_y_private.stack_ptr] = NULL; - } - if (__parser_y_private.file[__parser_y_private.stack_ptr]) { - fclose(__parser_y_private.file[__parser_y_private.stack_ptr]); - __parser_y_private.file[__parser_y_private.stack_ptr] = NULL; - yy_delete_buffer (YY_CURRENT_BUFFER); - yy_switch_to_buffer - (__parser_y_private.stack[__parser_y_private.stack_ptr]); - } - if (--__parser_y_private.stack_ptr < 0) { - yyterminate(); - } +<<EOF>> { + if (__parser_y_private.filename[__parser_y_private.stack_ptr]) { + free(__parser_y_private.filename[__parser_y_private.stack_ptr]); + __parser_y_private.filename[__parser_y_private.stack_ptr] = NULL; + } + if (__parser_y_private.file[__parser_y_private.stack_ptr]) { + fclose(__parser_y_private.file[__parser_y_private.stack_ptr]); + __parser_y_private.file[__parser_y_private.stack_ptr] = NULL; + yy_delete_buffer (YY_CURRENT_BUFFER); + yy_switch_to_buffer + (__parser_y_private.stack[__parser_y_private.stack_ptr]); + } + if (--__parser_y_private.stack_ptr < 0) { + yyterminate(); + } } -^[\t ]+ return FIRST_SPACES; +^[\t ]+ return FIRST_SPACES; -[\t ]+ /* ignore spaces in line */ ; +[\t ]+ /* ignore spaces in line */ ; -= return EQUAL; += return EQUAL; -\n|#.*\n { - __parser_y_private.line[__parser_y_private.stack_ptr]++; - return EOL; - } +\n|#.*\n { + __parser_y_private.line[__parser_y_private.stack_ptr]++; + return EOL; + } -config return CONFIG; -setup return SETUP; -conn return CONN; -ca return CA; -include return INCLUDE; -version return FILE_VERSION; +config return CONFIG; +setup return SETUP; +conn return CONN; +ca return CA; +include return INCLUDE; +version return FILE_VERSION; -[^\"= \t\n]+ { - yylval.s = strdup(yytext); - return STRING; - } +[^\"= \t\n]+ { + yylval.s = strdup(yytext); + return STRING; + } -\"[^\"\n]*\" { - yylval.s = strdup(yytext+1); - if (yylval.s) yylval.s[strlen(yylval.s)-1]='\0'; - return STRING; - } +\"[^\"\n]*\" { + yylval.s = strdup(yytext+1); + if (yylval.s) yylval.s[strlen(yylval.s)-1]='\0'; + return STRING; + } -. yyerror(yytext); +. yyerror(yytext); %% int yywrap(void) { - return 1; + return 1; } diff --git a/src/starter/parser.y b/src/starter/parser.y index 14148d965..4533228c2 100644 --- a/src/starter/parser.y +++ b/src/starter/parser.y @@ -11,8 +11,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: parser.y 3267 2007-10-08 19:57:54Z andreas $ */ #include <stdio.h> @@ -27,7 +25,7 @@ #include "parser.h" #define YYERROR_VERBOSE -#define ERRSTRING_LEN 256 +#define ERRSTRING_LEN 256 /** * Bison @@ -64,220 +62,215 @@ extern kw_entry_t *in_word_set (char *str, unsigned int len); */ config_file: - config_file section_or_include - | /* NULL */ - ; + config_file section_or_include + | /* NULL */ + ; section_or_include: - FILE_VERSION STRING EOL - { - free($2); - } - | CONFIG SETUP EOL - { - _parser_kw = &(_parser_cfg->config_setup); - _parser_kw_last = NULL; - } kw_section - | CONN STRING EOL - { - section_list_t *section = (section_list_t *)alloc_thing(section_list_t - , "section_list_t"); - - section->name = clone_str($2, "conn section name"); - section->kw = NULL; - section->next = NULL; - _parser_kw = &(section->kw); - if (!_parser_cfg->conn_first) - _parser_cfg->conn_first = section; - if (_parser_cfg->conn_last) - _parser_cfg->conn_last->next = section; - _parser_cfg->conn_last = section; - _parser_kw_last = NULL; - free($2); - } kw_section - | CA STRING EOL - { - section_list_t *section = (section_list_t *)alloc_thing(section_list_t - , "section_list_t"); - section->name = clone_str($2, "ca section name"); - section->kw = NULL; - section->next = NULL; - _parser_kw = &(section->kw); - if (!_parser_cfg->ca_first) - _parser_cfg->ca_first = section; - if (_parser_cfg->ca_last) - _parser_cfg->ca_last->next = section; - _parser_cfg->ca_last = section; - _parser_kw_last = NULL; - free($2); - } kw_section - | INCLUDE STRING - { - extern void _parser_y_include (const char *f); - _parser_y_include($2); - free($2); - } EOL - | EOL - ; + FILE_VERSION STRING EOL + { + free($2); + } + | CONFIG SETUP EOL + { + _parser_kw = &(_parser_cfg->config_setup); + _parser_kw_last = NULL; + } kw_section + | CONN STRING EOL + { + section_list_t *section = malloc_thing(section_list_t); + + section->name = clone_str($2); + section->kw = NULL; + section->next = NULL; + _parser_kw = &(section->kw); + if (!_parser_cfg->conn_first) + _parser_cfg->conn_first = section; + if (_parser_cfg->conn_last) + _parser_cfg->conn_last->next = section; + _parser_cfg->conn_last = section; + _parser_kw_last = NULL; + free($2); + } kw_section + | CA STRING EOL + { + section_list_t *section = malloc_thing(section_list_t); + section->name = clone_str($2); + section->kw = NULL; + section->next = NULL; + _parser_kw = &(section->kw); + if (!_parser_cfg->ca_first) + _parser_cfg->ca_first = section; + if (_parser_cfg->ca_last) + _parser_cfg->ca_last->next = section; + _parser_cfg->ca_last = section; + _parser_kw_last = NULL; + free($2); + } kw_section + | INCLUDE STRING + { + extern void _parser_y_include (const char *f); + _parser_y_include($2); + free($2); + } EOL + | EOL + ; kw_section: - FIRST_SPACES statement_kw EOL kw_section - | - ; + FIRST_SPACES statement_kw EOL kw_section + | + ; statement_kw: - STRING EQUAL STRING - { - kw_list_t *new; - kw_entry_t *entry = in_word_set($1, strlen($1)); - - if (entry == NULL) - { - snprintf(errbuf, ERRSTRING_LEN, "unknown keyword '%s'", $1); - yyerror(errbuf); - } - else if (_parser_kw) + STRING EQUAL STRING { - new = (kw_list_t *)alloc_thing(kw_list_t, "kw_list_t"); - new->entry = entry; - new->value = clone_str($3, "kw_list value"); - new->next = NULL; - if (_parser_kw_last) - _parser_kw_last->next = new; - _parser_kw_last = new; - if (!*_parser_kw) - *_parser_kw = new; + kw_list_t *new; + kw_entry_t *entry = in_word_set($1, strlen($1)); + + if (entry == NULL) + { + snprintf(errbuf, ERRSTRING_LEN, "unknown keyword '%s'", $1); + yyerror(errbuf); + } + else if (_parser_kw) + { + new = (kw_list_t *)malloc_thing(kw_list_t); + new->entry = entry; + new->value = clone_str($3); + new->next = NULL; + if (_parser_kw_last) + _parser_kw_last->next = new; + _parser_kw_last = new; + if (!*_parser_kw) + *_parser_kw = new; + } + free($1); + free($3); } - free($1); - free($3); - } - | STRING EQUAL - { - free($1); - } - | - ; + | STRING EQUAL + { + free($1); + } + | + ; %% void yyerror(const char *s) { - if (_save_errors_) - _parser_y_error(parser_errstring, ERRSTRING_LEN, s); + if (_save_errors_) + _parser_y_error(parser_errstring, ERRSTRING_LEN, s); } config_parsed_t * parser_load_conf(const char *file) { - config_parsed_t *cfg = NULL; - int err = 0; - FILE *f; + config_parsed_t *cfg = NULL; + int err = 0; + FILE *f; - extern void _parser_y_init (const char *f); - extern FILE *yyin; + extern void _parser_y_init (const char *f); + extern FILE *yyin; - memset(parser_errstring, 0, ERRSTRING_LEN+1); + memset(parser_errstring, 0, ERRSTRING_LEN+1); - cfg = (config_parsed_t *)alloc_thing(config_parsed_t, "config_parsed_t"); - if (cfg) - { - memset(cfg, 0, sizeof(config_parsed_t)); - f = fopen(file, "r"); - if (f) + cfg = (config_parsed_t *)malloc_thing(config_parsed_t); + if (cfg) { - yyin = f; - _parser_y_init(file); - _save_errors_ = 1; - _parser_cfg = cfg; + memset(cfg, 0, sizeof(config_parsed_t)); + f = fopen(file, "r"); + if (f) + { + yyin = f; + _parser_y_init(file); + _save_errors_ = 1; + _parser_cfg = cfg; + + if (yyparse() !=0 ) + { + if (parser_errstring[0] == '\0') + { + snprintf(parser_errstring, ERRSTRING_LEN, "Unknown error..."); + } + _save_errors_ = 0; + while (yyparse() != 0); + err++; + } + else if (parser_errstring[0] != '\0') + { + err++; + } + else + { + /** + * Config valid + */ + } - if (yyparse() !=0 ) - { - if (parser_errstring[0] == '\0') + fclose(f); + } + else { - snprintf(parser_errstring, ERRSTRING_LEN, "Unknown error..."); + snprintf(parser_errstring, ERRSTRING_LEN, "can't load file '%s'", file); + err++; } - _save_errors_ = 0; - while (yyparse() != 0); - err++; - } - else if (parser_errstring[0] != '\0') - { - err++; - } - else - { - /** - * Config valid - */ - } - - fclose(f); } else { - snprintf(parser_errstring, ERRSTRING_LEN, "can't load file '%s'", file); - err++; + snprintf(parser_errstring, ERRSTRING_LEN, "can't allocate memory"); + err++; } - } - else - { - snprintf(parser_errstring, ERRSTRING_LEN, "can't allocate memory"); - err++; - } - if (err) - { - plog("%s", parser_errstring); + if (err) + { + plog("%s", parser_errstring); - if (cfg) - parser_free_conf(cfg); - cfg = NULL; - } + if (cfg) + parser_free_conf(cfg); + cfg = NULL; + } - return cfg; + return cfg; } static void parser_free_kwlist(kw_list_t *list) { - kw_list_t *elt; + kw_list_t *elt; - while (list) - { - elt = list; - list = list->next; - if (elt->value) - pfree(elt->value); - pfree(elt); - } + while (list) + { + elt = list; + list = list->next; + free(elt->value); + free(elt); + } } void parser_free_conf(config_parsed_t *cfg) { - section_list_t *sec; - if (cfg) - { - parser_free_kwlist(cfg->config_setup); - while (cfg->conn_first) - { - sec = cfg->conn_first; - cfg->conn_first = cfg->conn_first->next; - if (sec->name) - pfree(sec->name); - parser_free_kwlist(sec->kw); - pfree(sec); - } - while (cfg->ca_first) + section_list_t *sec; + if (cfg) { - sec = cfg->ca_first; - cfg->ca_first = cfg->ca_first->next; - if (sec->name) - pfree(sec->name); - parser_free_kwlist(sec->kw); - pfree(sec); + parser_free_kwlist(cfg->config_setup); + while (cfg->conn_first) + { + sec = cfg->conn_first; + cfg->conn_first = cfg->conn_first->next; + free(sec->name); + parser_free_kwlist(sec->kw); + free(sec); + } + while (cfg->ca_first) + { + sec = cfg->ca_first; + cfg->ca_first = cfg->ca_first->next; + free(sec->name); + parser_free_kwlist(sec->kw); + free(sec); + } + free(cfg); } - pfree(cfg); - } } diff --git a/src/starter/starter.c b/src/starter/starter.c index e4ad5286c..2d2f452b5 100644 --- a/src/starter/starter.c +++ b/src/starter/starter.c @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: starter.c 4632 2008-11-11 18:37:19Z martin $ */ #include <sys/types.h> @@ -71,662 +69,666 @@ static unsigned int _action_ = 0; static void fsig(int signal) { - switch (signal) - { - case SIGCHLD: + switch (signal) { - int status; - pid_t pid; - char *name = NULL; - - while ((pid = waitpid(-1, &status, WNOHANG)) > 0) - { - if (pid == starter_pluto_pid()) - name = " (Pluto)"; - if (pid == starter_charon_pid()) - name = " (Charon)"; - if (WIFSIGNALED(status)) - DBG(DBG_CONTROL, - DBG_log("child %d%s has been killed by sig %d\n", - pid, name?name:"", WTERMSIG(status)) - ) - else if (WIFSTOPPED(status)) - DBG(DBG_CONTROL, - DBG_log("child %d%s has been stopped by sig %d\n", - pid, name?name:"", WSTOPSIG(status)) - ) - else if (WIFEXITED(status)) - DBG(DBG_CONTROL, - DBG_log("child %d%s has quit (exit code %d)\n", - pid, name?name:"", WEXITSTATUS(status)) - ) - else - DBG(DBG_CONTROL, - DBG_log("child %d%s has quit", pid, name?name:"") - ) - if (pid == starter_pluto_pid()) - starter_pluto_sigchild(pid); - if (pid == starter_charon_pid()) - starter_charon_sigchild(pid); - } + case SIGCHLD: + { + int status; + pid_t pid; + char *name = NULL; + + while ((pid = waitpid(-1, &status, WNOHANG)) > 0) + { + if (pid == starter_pluto_pid()) + name = " (Pluto)"; + if (pid == starter_charon_pid()) + name = " (Charon)"; + if (WIFSIGNALED(status)) + DBG(DBG_CONTROL, + DBG_log("child %d%s has been killed by sig %d\n", + pid, name?name:"", WTERMSIG(status)) + ) + else if (WIFSTOPPED(status)) + DBG(DBG_CONTROL, + DBG_log("child %d%s has been stopped by sig %d\n", + pid, name?name:"", WSTOPSIG(status)) + ) + else if (WIFEXITED(status)) + DBG(DBG_CONTROL, + DBG_log("child %d%s has quit (exit code %d)\n", + pid, name?name:"", WEXITSTATUS(status)) + ) + else + DBG(DBG_CONTROL, + DBG_log("child %d%s has quit", pid, name?name:"") + ) + if (pid == starter_pluto_pid()) + starter_pluto_sigchild(pid); + if (pid == starter_charon_pid()) + starter_charon_sigchild(pid); + } + } + break; + + case SIGPIPE: + /** ignore **/ + break; + + case SIGALRM: + _action_ |= FLAG_ACTION_START_PLUTO; + _action_ |= FLAG_ACTION_START_CHARON; + break; + + case SIGHUP: + _action_ |= FLAG_ACTION_UPDATE; + break; + + case SIGTERM: + case SIGQUIT: + case SIGINT: + _action_ |= FLAG_ACTION_QUIT; + break; + + case SIGUSR1: + _action_ |= FLAG_ACTION_RELOAD; + _action_ |= FLAG_ACTION_UPDATE; + break; + + default: + plog("fsig(): unknown signal %d -- investigate", signal); + break; } - break; - - case SIGPIPE: - /** ignore **/ - break; - - case SIGALRM: - _action_ |= FLAG_ACTION_START_PLUTO; - _action_ |= FLAG_ACTION_START_CHARON; - break; - - case SIGHUP: - _action_ |= FLAG_ACTION_UPDATE; - break; - - case SIGTERM: - case SIGQUIT: - case SIGINT: - _action_ |= FLAG_ACTION_QUIT; - break; - - case SIGUSR1: - _action_ |= FLAG_ACTION_RELOAD; - _action_ |= FLAG_ACTION_UPDATE; - break; - - default: - plog("fsig(): unknown signal %d -- investigate", signal); - break; - } } static void generate_selfcert() { - struct stat stb; - - /* if ipsec.secrets file is missing then generate RSA default key pair */ - if (stat(SECRETS_FILE, &stb) != 0) - { - mode_t oldmask; - FILE *f; - uid_t uid = 0; - gid_t gid = 0; + struct stat stb; + + /* if ipsec.secrets file is missing then generate RSA default key pair */ + if (stat(SECRETS_FILE, &stb) != 0) + { + mode_t oldmask; + FILE *f; + uid_t uid = 0; + gid_t gid = 0; #ifdef IPSEC_GROUP - { - char buf[1024]; - struct group group, *grp; - - if (getgrnam_r(IPSEC_GROUP, &group, buf, sizeof(buf), &grp) == 0 && - grp) { - gid = grp->gr_gid; + char buf[1024]; + struct group group, *grp; + + if (getgrnam_r(IPSEC_GROUP, &group, buf, sizeof(buf), &grp) == 0 && grp) + { + gid = grp->gr_gid; + } } - } #endif #ifdef IPSEC_USER - { - char buf[1024]; - struct passwd passwd, *pwp; - - if (getpwnam_r(IPSEC_USER, &passwd, buf, sizeof(buf), &pwp) == 0 && - pwp) { - uid = pwp->pw_uid; + char buf[1024]; + struct passwd passwd, *pwp; + + if (getpwnam_r(IPSEC_USER, &passwd, buf, sizeof(buf), &pwp) == 0 && pwp) + { + uid = pwp->pw_uid; + } + } +#endif + setegid(gid); + seteuid(uid); + ignore_result(system("ipsec scepclient --out pkcs1 --out cert-self --quiet")); + seteuid(0); + setegid(0); + + /* ipsec.secrets is root readable only */ + oldmask = umask(0066); + + f = fopen(SECRETS_FILE, "w"); + if (f) + { + fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n"); + fprintf(f, "\n"); + fprintf(f, ": RSA myKey.der\n"); + fclose(f); } + ignore_result(chown(SECRETS_FILE, uid, gid)); + umask(oldmask); } -#endif - setegid(gid); - seteuid(uid); - ignore_result(system("ipsec scepclient --out pkcs1 --out cert-self --quiet")); - seteuid(0); - setegid(0); - - /* ipsec.secrets is root readable only */ - oldmask = umask(0066); - - f = fopen(SECRETS_FILE, "w"); - if (f) - { - fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n"); - fprintf(f, "\n"); - fprintf(f, ": RSA myKey.der\n"); - fclose(f); - } - ignore_result(chown(SECRETS_FILE, uid, gid)); - umask(oldmask); - } } static void usage(char *name) { - fprintf(stderr, "Usage: starter [--nofork] [--auto-update <sec>] " - "[--debug|--debug-more|--debug-all]\n"); - exit(LSB_RC_INVALID_ARGUMENT); + fprintf(stderr, "Usage: starter [--nofork] [--auto-update <sec>] " + "[--debug|--debug-more|--debug-all]\n"); + exit(LSB_RC_INVALID_ARGUMENT); } int main (int argc, char **argv) { - starter_config_t *cfg = NULL; - starter_config_t *new_cfg; - starter_conn_t *conn, *conn2; - starter_ca_t *ca, *ca2; - - struct stat stb; - - char *err = NULL; - int i; - int id = 1; - struct timeval tv; - unsigned long auto_update = 0; - time_t last_reload; - bool no_fork = FALSE; - - /* global variables defined in log.h */ - log_to_stderr = TRUE; - base_debugging = DBG_NONE; - - /* parse command line */ - for (i = 1; i < argc; i++) - { - if (streq(argv[i], "--debug")) + starter_config_t *cfg = NULL; + starter_config_t *new_cfg; + starter_conn_t *conn, *conn2; + starter_ca_t *ca, *ca2; + + struct stat stb; + + char *err = NULL; + int i; + int id = 1; + struct timeval tv; + unsigned long auto_update = 0; + time_t last_reload; + bool no_fork = FALSE; + bool attach_gdb = FALSE; + + /* global variables defined in log.h */ + log_to_stderr = TRUE; + base_debugging = DBG_NONE; + + /* parse command line */ + for (i = 1; i < argc; i++) { - base_debugging |= DBG_CONTROL; + if (streq(argv[i], "--debug")) + { + base_debugging |= DBG_CONTROL; + } + else if (streq(argv[i], "--debug-more")) + { + base_debugging |= DBG_CONTROLMORE; + } + else if (streq(argv[i], "--debug-all")) + { + base_debugging |= DBG_ALL; + } + else if (streq(argv[i], "--nofork")) + { + no_fork = TRUE; + } + else if (streq(argv[i], "--attach-gdb")) + { + no_fork = TRUE; + attach_gdb = TRUE; + } + else if (streq(argv[i], "--auto-update") && i+1 < argc) + { + auto_update = atoi(argv[++i]); + if (!auto_update) + usage(argv[0]); + } + else + { + usage(argv[0]); + } } - else if (streq(argv[i], "--debug-more")) + + /* Init */ + init_log("ipsec_starter"); + cur_debugging = base_debugging; + + signal(SIGHUP, fsig); + signal(SIGCHLD, fsig); + signal(SIGPIPE, fsig); + signal(SIGINT, fsig); + signal(SIGTERM, fsig); + signal(SIGQUIT, fsig); + signal(SIGALRM, fsig); + signal(SIGUSR1, fsig); + + plog("Starting strongSwan "VERSION" IPsec [starter]..."); + + /* verify that we can start */ + if (getuid() != 0) { - base_debugging |= DBG_CONTROLMORE; + plog("permission denied (must be superuser)"); + exit(LSB_RC_NOT_ALLOWED); } - else if (streq(argv[i], "--debug-all")) + + if (stat(PLUTO_PID_FILE, &stb) == 0) { - base_debugging |= DBG_ALL; + plog("pluto is already running (%s exists) -- skipping pluto start", PLUTO_PID_FILE); } - else if (streq(argv[i], "--nofork")) + else { - no_fork = TRUE; + _action_ |= FLAG_ACTION_START_PLUTO; } - else if (streq(argv[i], "--auto-update") && i+1 < argc) + if (stat(CHARON_PID_FILE, &stb) == 0) { - auto_update = atoi(argv[++i]); - if (!auto_update) - usage(argv[0]); + plog("charon is already running (%s exists) -- skipping charon start", CHARON_PID_FILE); } else { - usage(argv[0]); + _action_ |= FLAG_ACTION_START_CHARON; } - } - - /* Init */ - init_log("ipsec_starter"); - cur_debugging = base_debugging; - - signal(SIGHUP, fsig); - signal(SIGCHLD, fsig); - signal(SIGPIPE, fsig); - signal(SIGINT, fsig); - signal(SIGTERM, fsig); - signal(SIGQUIT, fsig); - signal(SIGALRM, fsig); - signal(SIGUSR1, fsig); - - plog("Starting strongSwan %s IPsec [starter]...", ipsec_version_code()); - - /* verify that we can start */ - if (getuid() != 0) - { - plog("permission denied (must be superuser)"); - exit(LSB_RC_NOT_ALLOWED); - } - - if (stat(PLUTO_PID_FILE, &stb) == 0) - { - plog("pluto is already running (%s exists) -- skipping pluto start", PLUTO_PID_FILE); - } - else - { - _action_ |= FLAG_ACTION_START_PLUTO; - } - if (stat(CHARON_PID_FILE, &stb) == 0) - { - plog("charon is already running (%s exists) -- skipping charon start", CHARON_PID_FILE); - } - else - { - _action_ |= FLAG_ACTION_START_CHARON; - } - if (stat(DEV_RANDOM, &stb) != 0) - { - plog("unable to start strongSwan IPsec -- no %s!", DEV_RANDOM); - exit(LSB_RC_FAILURE); - } - - if (stat(DEV_URANDOM, &stb)!= 0) - { - plog("unable to start strongSwan IPsec -- no %s!", DEV_URANDOM); - exit(LSB_RC_FAILURE); - } - - cfg = confread_load(CONFIG_FILE); - if (cfg == NULL || cfg->err > 0) - { - plog("unable to start strongSwan -- fatal errors in config"); - if (cfg) + if (stat(DEV_RANDOM, &stb) != 0) { - confread_free(cfg); + plog("unable to start strongSwan IPsec -- no %s!", DEV_RANDOM); + exit(LSB_RC_FAILURE); } - exit(LSB_RC_INVALID_ARGUMENT); - } - /* determine if we have a native netkey IPsec stack */ - if (!starter_netkey_init()) - { - plog("no netkey IPSec stack detected"); - if (!starter_klips_init()) + if (stat(DEV_URANDOM, &stb)!= 0) { - plog("no KLIPS IPSec stack detected"); - exit(LSB_RC_FAILURE); + plog("unable to start strongSwan IPsec -- no %s!", DEV_URANDOM); + exit(LSB_RC_FAILURE); } - } - - last_reload = time(NULL); - - if (stat(STARTER_PID_FILE, &stb) == 0) - { - plog("starter is already running (%s exists) -- no fork done", STARTER_PID_FILE); - exit(LSB_RC_SUCCESS); - } - - generate_selfcert(); - - /* fork if we're not debugging stuff */ - if (!no_fork) - { - log_to_stderr = FALSE; - switch (fork()) + cfg = confread_load(CONFIG_FILE); + if (cfg == NULL || cfg->err > 0) { - case 0: - { - int fnull = open("/dev/null", O_RDWR); - - if (fnull >= 0) + plog("unable to start strongSwan -- fatal errors in config"); + if (cfg) { - dup2(fnull, STDIN_FILENO); - dup2(fnull, STDOUT_FILENO); - dup2(fnull, STDERR_FILENO); - close(fnull); + confread_free(cfg); } - setsid(); - } - break; - case -1: - plog("can't fork: %s", strerror(errno)); - break; - default: - exit(LSB_RC_SUCCESS); + exit(LSB_RC_INVALID_ARGUMENT); } - } - /* save pid file in /var/run/starter.pid */ - { - FILE *fd = fopen(STARTER_PID_FILE, "w"); - - if (fd) + /* determine if we have a native netkey IPsec stack */ + if (!starter_netkey_init()) { - fprintf(fd, "%u\n", getpid()); - fclose(fd); + plog("no netkey IPsec stack detected"); + if (!starter_klips_init()) + { + plog("no KLIPS IPsec stack detected"); + plog("no known IPsec stack detected, ignoring!"); + } } - } - - for (;;) - { - /* - * Stop pluto/charon (if started) and exit - */ - if (_action_ & FLAG_ACTION_QUIT) + + last_reload = time(NULL); + + if (stat(STARTER_PID_FILE, &stb) == 0) { - if (starter_pluto_pid()) - starter_stop_pluto(); - if (starter_charon_pid()) - starter_stop_charon(); - starter_netkey_cleanup(); - confread_free(cfg); - unlink(STARTER_PID_FILE); - unlink(INFO_FILE); -#ifdef LEAK_DETECTIVE - report_leaks(); -#endif /* LEAK_DETECTIVE */ - close_log(); - plog("ipsec starter stopped"); - exit(LSB_RC_SUCCESS); + plog("starter is already running (%s exists) -- no fork done", STARTER_PID_FILE); + exit(LSB_RC_SUCCESS); } + + generate_selfcert(); - /* - * Delete all connections. Will be added below - */ - if (_action_ & FLAG_ACTION_RELOAD) + /* fork if we're not debugging stuff */ + if (!no_fork) { - if (starter_pluto_pid() || starter_charon_pid()) - { - for (conn = cfg->conn_first; conn; conn = conn->next) + log_to_stderr = FALSE; + + switch (fork()) { - if (conn->state == STATE_ADDED) - { - if (starter_charon_pid()) - { - starter_stroke_del_conn(conn); - } - if (starter_pluto_pid()) + case 0: { - starter_whack_del_conn(conn); + int fnull = open("/dev/null", O_RDWR); + + if (fnull >= 0) + { + dup2(fnull, STDIN_FILENO); + dup2(fnull, STDOUT_FILENO); + dup2(fnull, STDERR_FILENO); + close(fnull); + } + setsid(); } - conn->state = STATE_TO_ADD; - } + break; + case -1: + plog("can't fork: %s", strerror(errno)); + break; + default: + exit(LSB_RC_SUCCESS); } - for (ca = cfg->ca_first; ca; ca = ca->next) + } + + /* save pid file in /var/run/starter.pid */ + { + FILE *fd = fopen(STARTER_PID_FILE, "w"); + + if (fd) { - if (ca->state == STATE_ADDED) - { - if (starter_charon_pid()) - { - starter_stroke_del_ca(ca); - } - if (starter_pluto_pid()) - { - starter_whack_del_ca(ca); - } - ca->state = STATE_TO_ADD; - } + fprintf(fd, "%u\n", getpid()); + fclose(fd); } - } - _action_ &= ~FLAG_ACTION_RELOAD; } - /* - * Update configuration - */ - if (_action_ & FLAG_ACTION_UPDATE) + for (;;) { - err = NULL; - DBG(DBG_CONTROL, - DBG_log("Reloading config...") - ); - new_cfg = confread_load(CONFIG_FILE); - - if (new_cfg && (new_cfg->err + new_cfg->non_fatal_err == 0)) - { - /* Switch to new config. New conn will be loaded below */ - if (!starter_cmp_defaultroute(&new_cfg->defaultroute - , &cfg->defaultroute)) + /* + * Stop pluto/charon (if started) and exit + */ + if (_action_ & FLAG_ACTION_QUIT) { - _action_ |= FLAG_ACTION_LISTEN; + if (starter_pluto_pid()) + starter_stop_pluto(); + if (starter_charon_pid()) + starter_stop_charon(); + starter_netkey_cleanup(); + confread_free(cfg); + unlink(STARTER_PID_FILE); + unlink(INFO_FILE); +#ifdef LEAK_DETECTIVE + report_leaks(); +#endif /* LEAK_DETECTIVE */ + close_log(); + plog("ipsec starter stopped"); + exit(LSB_RC_SUCCESS); } - if (!starter_cmp_pluto(cfg, new_cfg)) + /* + * Delete all connections. Will be added below + */ + if (_action_ & FLAG_ACTION_RELOAD) { - plog("Pluto has changed"); - if (starter_pluto_pid()) - starter_stop_pluto(); - _action_ &= ~FLAG_ACTION_LISTEN; - _action_ |= FLAG_ACTION_START_PLUTO; + if (starter_pluto_pid() || starter_charon_pid()) + { + for (conn = cfg->conn_first; conn; conn = conn->next) + { + if (conn->state == STATE_ADDED) + { + if (starter_charon_pid()) + { + starter_stroke_del_conn(conn); + } + if (starter_pluto_pid()) + { + starter_whack_del_conn(conn); + } + conn->state = STATE_TO_ADD; + } + } + for (ca = cfg->ca_first; ca; ca = ca->next) + { + if (ca->state == STATE_ADDED) + { + if (starter_charon_pid()) + { + starter_stroke_del_ca(ca); + } + if (starter_pluto_pid()) + { + starter_whack_del_ca(ca); + } + ca->state = STATE_TO_ADD; + } + } + } + _action_ &= ~FLAG_ACTION_RELOAD; } - else + + /* + * Update configuration + */ + if (_action_ & FLAG_ACTION_UPDATE) { - /* Only reload conn and ca sections if pluto is not killed */ + err = NULL; + DBG(DBG_CONTROL, + DBG_log("Reloading config...") + ); + new_cfg = confread_load(CONFIG_FILE); - /* Look for new connections that are already loaded */ - for (conn = cfg->conn_first; conn; conn = conn->next) - { - if (conn->state == STATE_ADDED) + if (new_cfg && (new_cfg->err + new_cfg->non_fatal_err == 0)) { - for (conn2 = new_cfg->conn_first; conn2; conn2 = conn2->next) - { - if (conn2->state == STATE_TO_ADD && starter_cmp_conn(conn, conn2)) + /* Switch to new config. New conn will be loaded below */ + if (!starter_cmp_defaultroute(&new_cfg->defaultroute + , &cfg->defaultroute)) { - conn->state = STATE_REPLACED; - conn2->state = STATE_ADDED; - conn2->id = conn->id; - break; + _action_ |= FLAG_ACTION_LISTEN; } - } - } - } - /* Remove conn sections that have become unused */ - for (conn = cfg->conn_first; conn; conn = conn->next) - { - if (conn->state == STATE_ADDED) + if (!starter_cmp_pluto(cfg, new_cfg)) + { + plog("Pluto has changed"); + if (starter_pluto_pid()) + starter_stop_pluto(); + _action_ &= ~FLAG_ACTION_LISTEN; + _action_ |= FLAG_ACTION_START_PLUTO; + } + else + { + /* Only reload conn and ca sections if pluto is not killed */ + + /* Look for new connections that are already loaded */ + for (conn = cfg->conn_first; conn; conn = conn->next) + { + if (conn->state == STATE_ADDED) + { + for (conn2 = new_cfg->conn_first; conn2; conn2 = conn2->next) + { + if (conn2->state == STATE_TO_ADD && starter_cmp_conn(conn, conn2)) + { + conn->state = STATE_REPLACED; + conn2->state = STATE_ADDED; + conn2->id = conn->id; + break; + } + } + } + } + + /* Remove conn sections that have become unused */ + for (conn = cfg->conn_first; conn; conn = conn->next) + { + if (conn->state == STATE_ADDED) + { + if (starter_charon_pid()) + { + starter_stroke_del_conn(conn); + } + if (starter_pluto_pid()) + { + starter_whack_del_conn(conn); + } + } + } + + /* Look for new ca sections that are already loaded */ + for (ca = cfg->ca_first; ca; ca = ca->next) + { + if (ca->state == STATE_ADDED) + { + for (ca2 = new_cfg->ca_first; ca2; ca2 = ca2->next) + { + if (ca2->state == STATE_TO_ADD && starter_cmp_ca(ca, ca2)) + { + ca->state = STATE_REPLACED; + ca2->state = STATE_ADDED; + break; + } + } + } + } + + /* Remove ca sections that have become unused */ + for (ca = cfg->ca_first; ca; ca = ca->next) + { + if (ca->state == STATE_ADDED) + { + if (starter_charon_pid()) + { + starter_stroke_del_ca(ca); + } + if (starter_pluto_pid()) + { + starter_whack_del_ca(ca); + } + } + } + } + confread_free(cfg); + cfg = new_cfg; + } + else { - if (starter_charon_pid()) - { - starter_stroke_del_conn(conn); - } - if (starter_pluto_pid()) - { - starter_whack_del_conn(conn); - } + plog("can't reload config file due to errors -- keeping old one"); + if (new_cfg) + { + confread_free(new_cfg); + } } - } + _action_ &= ~FLAG_ACTION_UPDATE; + last_reload = time(NULL); + } - /* Look for new ca sections that are already loaded */ - for (ca = cfg->ca_first; ca; ca = ca->next) - { - if (ca->state == STATE_ADDED) + /* + * Start pluto + */ + if (_action_ & FLAG_ACTION_START_PLUTO) + { + if (cfg->setup.plutostart && !starter_pluto_pid()) { - for (ca2 = new_cfg->ca_first; ca2; ca2 = ca2->next) - { - if (ca2->state == STATE_TO_ADD && starter_cmp_ca(ca, ca2)) + DBG(DBG_CONTROL, + DBG_log("Attempting to start pluto...") + ); + + if (starter_start_pluto(cfg, no_fork, attach_gdb) == 0) + { + starter_whack_listen(); + } + else { - ca->state = STATE_REPLACED; - ca2->state = STATE_ADDED; - break; + /* schedule next try */ + alarm(PLUTO_RESTART_DELAY); } - } } - } + _action_ &= ~FLAG_ACTION_START_PLUTO; - /* Remove ca sections that have become unused */ - for (ca = cfg->ca_first; ca; ca = ca->next) - { - if (ca->state == STATE_ADDED) + for (ca = cfg->ca_first; ca; ca = ca->next) { - if (starter_charon_pid()) - { - starter_stroke_del_ca(ca); - } - if (starter_pluto_pid()) - { - starter_whack_del_ca(ca); - } + if (ca->state == STATE_ADDED) + ca->state = STATE_TO_ADD; } - } - } - confread_free(cfg); - cfg = new_cfg; - } - else - { - plog("can't reload config file due to errors -- keeping old one"); - if (new_cfg) - { - confread_free(new_cfg); - } - } - _action_ &= ~FLAG_ACTION_UPDATE; - last_reload = time(NULL); - } - /* - * Start pluto - */ - if (_action_ & FLAG_ACTION_START_PLUTO) - { - if (cfg->setup.plutostart && !starter_pluto_pid()) - { - DBG(DBG_CONTROL, - DBG_log("Attempting to start pluto...") - ); - - if (starter_start_pluto(cfg, no_fork) == 0) - { - starter_whack_listen(); - } - else - { - /* schedule next try */ - alarm(PLUTO_RESTART_DELAY); + for (conn = cfg->conn_first; conn; conn = conn->next) + { + if (conn->state == STATE_ADDED) + conn->state = STATE_TO_ADD; + } } - } - _action_ &= ~FLAG_ACTION_START_PLUTO; - - for (ca = cfg->ca_first; ca; ca = ca->next) - { - if (ca->state == STATE_ADDED) - ca->state = STATE_TO_ADD; - } - - for (conn = cfg->conn_first; conn; conn = conn->next) - { - if (conn->state == STATE_ADDED) - conn->state = STATE_TO_ADD; - } - } - - /* - * Start charon - */ - if (_action_ & FLAG_ACTION_START_CHARON) - { - if (cfg->setup.charonstart && !starter_charon_pid()) - { - DBG(DBG_CONTROL, - DBG_log("Attempting to start charon...") - ); - if (starter_start_charon(cfg, no_fork)) + + /* + * Start charon + */ + if (_action_ & FLAG_ACTION_START_CHARON) { - /* schedule next try */ - alarm(PLUTO_RESTART_DELAY); + if (cfg->setup.charonstart && !starter_charon_pid()) + { + DBG(DBG_CONTROL, + DBG_log("Attempting to start charon...") + ); + if (starter_start_charon(cfg, no_fork, attach_gdb)) + { + /* schedule next try */ + alarm(PLUTO_RESTART_DELAY); + } + starter_stroke_configure(cfg); + } + _action_ &= ~FLAG_ACTION_START_CHARON; } - starter_stroke_configure(cfg); - } - _action_ &= ~FLAG_ACTION_START_CHARON; - } - - /* - * Tell pluto to reread its interfaces - */ - if (_action_ & FLAG_ACTION_LISTEN) - { - if (starter_pluto_pid()) - { - starter_whack_listen(); - _action_ &= ~FLAG_ACTION_LISTEN; - } - } - /* - * Add stale conn and ca sections - */ - if (starter_pluto_pid() || starter_charon_pid()) - { - for (ca = cfg->ca_first; ca; ca = ca->next) - { - if (ca->state == STATE_TO_ADD) + /* + * Tell pluto to reread its interfaces + */ + if (_action_ & FLAG_ACTION_LISTEN) { - if (starter_charon_pid()) - { - starter_stroke_add_ca(ca); - } - if (starter_pluto_pid()) - { - starter_whack_add_ca(ca); - } - ca->state = STATE_ADDED; + if (starter_pluto_pid()) + { + starter_whack_listen(); + _action_ &= ~FLAG_ACTION_LISTEN; + } } - } - for (conn = cfg->conn_first; conn; conn = conn->next) - { - if (conn->state == STATE_TO_ADD) + /* + * Add stale conn and ca sections + */ + if (starter_pluto_pid() || starter_charon_pid()) { - if (conn->id == 0) - { - /* affect new unique id */ - conn->id = id++; - } - if (starter_charon_pid()) - { - starter_stroke_add_conn(cfg, conn); - } - if (starter_pluto_pid()) - { - starter_whack_add_conn(conn); - } - conn->state = STATE_ADDED; - - if (conn->startup == STARTUP_START) - { - if (conn->keyexchange == KEY_EXCHANGE_IKEV2) + for (ca = cfg->ca_first; ca; ca = ca->next) { - if (starter_charon_pid()) - { - starter_stroke_initiate_conn(conn); - } - } - else - { - if (starter_pluto_pid()) - { - starter_whack_initiate_conn(conn); - } - } - } - else if (conn->startup == STARTUP_ROUTE) - { - if (conn->keyexchange == KEY_EXCHANGE_IKEV2) - { - if (starter_charon_pid()) - { - starter_stroke_route_conn(conn); - } + if (ca->state == STATE_TO_ADD) + { + if (starter_charon_pid()) + { + starter_stroke_add_ca(ca); + } + if (starter_pluto_pid()) + { + starter_whack_add_ca(ca); + } + ca->state = STATE_ADDED; + } } - else + + for (conn = cfg->conn_first; conn; conn = conn->next) { - if (starter_pluto_pid()) - { - starter_whack_route_conn(conn); - } + if (conn->state == STATE_TO_ADD) + { + if (conn->id == 0) + { + /* affect new unique id */ + conn->id = id++; + } + if (starter_charon_pid()) + { + starter_stroke_add_conn(cfg, conn); + } + if (starter_pluto_pid()) + { + starter_whack_add_conn(conn); + } + conn->state = STATE_ADDED; + + if (conn->startup == STARTUP_START) + { + if (conn->keyexchange == KEY_EXCHANGE_IKEV2) + { + if (starter_charon_pid()) + { + starter_stroke_initiate_conn(conn); + } + } + else + { + if (starter_pluto_pid()) + { + starter_whack_initiate_conn(conn); + } + } + } + else if (conn->startup == STARTUP_ROUTE) + { + if (conn->keyexchange == KEY_EXCHANGE_IKEV2) + { + if (starter_charon_pid()) + { + starter_stroke_route_conn(conn); + } + } + else + { + if (starter_pluto_pid()) + { + starter_whack_route_conn(conn); + } + } + } + } } - } } - } - } - /* - * If auto_update activated, when to stop select - */ - if (auto_update) - { - time_t now = time(NULL); + /* + * If auto_update activated, when to stop select + */ + if (auto_update) + { + time_t now = time(NULL); - tv.tv_sec = (now < last_reload + auto_update) - ? (last_reload + auto_update-now) : 0; - tv.tv_usec = 0; - } + tv.tv_sec = (now < last_reload + auto_update) + ? (last_reload + auto_update-now) : 0; + tv.tv_usec = 0; + } - /* - * Wait for something to happen - */ - if (select(0, NULL, NULL, NULL, auto_update ? &tv : NULL) == 0) - { - /* timeout -> auto_update */ - _action_ |= FLAG_ACTION_UPDATE; + /* + * Wait for something to happen + */ + if (select(0, NULL, NULL, NULL, auto_update ? &tv : NULL) == 0) + { + /* timeout -> auto_update */ + _action_ |= FLAG_ACTION_UPDATE; + } } - } - exit(LSB_RC_SUCCESS); + exit(LSB_RC_SUCCESS); } diff --git a/src/starter/starterstroke.c b/src/starter/starterstroke.c index a1339f2a5..054e37fa7 100644 --- a/src/starter/starterstroke.c +++ b/src/starter/starterstroke.c @@ -11,8 +11,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: starterstroke.c 4856 2009-02-05 22:13:48Z andreas $ */ #include <sys/types.h> @@ -21,10 +19,10 @@ #include <stddef.h> #include <unistd.h> #include <stdlib.h> +#include <string.h> #include <errno.h> #include <netinet/in.h> #include <arpa/inet.h> -#include <linux/xfrm.h> #include <freeswan.h> @@ -42,6 +40,15 @@ #define IPV6_LEN 16 /** + * Mode of an IPsec SA, must be the same as in charons kernel_ipsec.h + */ +enum ipsec_mode_t { + MODE_TRANSPORT = 1, + MODE_TUNNEL, + MODE_BEET +}; + +/** * Authentication methods, must be the same as in charons authenticator.h */ enum auth_method_t { @@ -68,9 +75,12 @@ static char* push_string(stroke_msg_t *msg, char *string) static int send_stroke_msg (stroke_msg_t *msg) { - struct sockaddr_un ctl_addr = { AF_UNIX, CHARON_CTL_FILE }; + struct sockaddr_un ctl_addr; int byte_count; char buffer[64]; + + ctl_addr.sun_family = AF_UNIX; + strcpy(ctl_addr.sun_path, CHARON_CTL_FILE); /* starter is not called from commandline, and therefore absolutely silent */ msg->output_verbosity = -1; @@ -164,9 +174,14 @@ static void starter_stroke_add_end(stroke_msg_t *msg, stroke_end_t *msg_end, sta { char buffer[INET6_ADDRSTRLEN]; + msg_end->auth = push_string(msg, conn_end->auth); + msg_end->auth2 = push_string(msg, conn_end->auth2); msg_end->id = push_string(msg, conn_end->id); + msg_end->id2 = push_string(msg, conn_end->id2); msg_end->cert = push_string(msg, conn_end->cert); + msg_end->cert2 = push_string(msg, conn_end->cert2); msg_end->ca = push_string(msg, conn_end->ca); + msg_end->ca2 = push_string(msg, conn_end->ca2); msg_end->groups = push_string(msg, conn_end->groups); msg_end->updown = push_string(msg, conn_end->updown); ip_address2string(&conn_end->addr, buffer, sizeof(buffer)); @@ -224,7 +239,7 @@ int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn) msg.add_conn.name = push_string(&msg, connection_name(conn)); /* PUBKEY is preferred to PSK and EAP */ - if (conn->policy & POLICY_RSASIG || conn->policy & POLICY_ECDSASIG) + if (conn->policy & POLICY_PUBKEY) { msg.add_conn.auth_method = AUTH_PUBKEY; } @@ -242,20 +257,20 @@ int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn) if (conn->policy & POLICY_TUNNEL) { - msg.add_conn.mode = XFRM_MODE_TUNNEL; + msg.add_conn.mode = MODE_TUNNEL; } else if (conn->policy & POLICY_BEET) { - msg.add_conn.mode = XFRM_MODE_BEET; + msg.add_conn.mode = MODE_BEET; } else if (conn->policy & POLICY_PROXY) { - msg.add_conn.mode = XFRM_MODE_TRANSPORT; + msg.add_conn.mode = MODE_TRANSPORT; msg.add_conn.proxy_mode = TRUE; } else { - msg.add_conn.mode = XFRM_MODE_TRANSPORT; + msg.add_conn.mode = MODE_TRANSPORT; } if (!(conn->policy & POLICY_DONT_REKEY)) diff --git a/src/starter/starterstroke.h b/src/starter/starterstroke.h index e6b9e5504..f9b01c99a 100644 --- a/src/starter/starterstroke.h +++ b/src/starter/starterstroke.h @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: starterstroke.h 3825 2008-04-17 15:01:57Z martin $ */ #ifndef _STARTER_STROKE_H_ diff --git a/src/starter/starterwhack.c b/src/starter/starterwhack.c index 8b7d500b8..44b442ae2 100644 --- a/src/starter/starterwhack.c +++ b/src/starter/starterwhack.c @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: starterwhack.c 3880 2008-04-27 10:49:31Z andreas $ */ #include <sys/types.h> @@ -19,6 +17,7 @@ #include <sys/un.h> #include <stddef.h> #include <unistd.h> +#include <string.h> #include <errno.h> #include <freeswan.h> @@ -32,386 +31,389 @@ #include "confread.h" #include "files.h" -#define ip_version(string) (strchr(string, '.') ? AF_INET : AF_INET6) +#define ip_version(string) (strchr(string, '.') ? AF_INET : AF_INET6) static int pack_str (char **p, char **next, char **roof) { - const char *s = (*p==NULL) ? "" : *p; /* note: NULL becomes ""! */ - size_t len = strlen(s) + 1; - - if ((*roof - *next) < len) - { - return 0; /* not enough space */ - } - else - { - strcpy(*next, s); - *next += len; - *p = NULL; /* don't send pointers on the wire! */ - return 1; - } + const char *s = (*p==NULL) ? "" : *p; /* note: NULL becomes ""! */ + size_t len = strlen(s) + 1; + + if ((*roof - *next) < len) + { + return 0; /* not enough space */ + } + else + { + strcpy(*next, s); + *next += len; + *p = NULL; /* don't send pointers on the wire! */ + return 1; + } } static int send_whack_msg (whack_message_t *msg) { - struct sockaddr_un ctl_addr = { AF_UNIX, PLUTO_CTL_FILE }; - int sock; - ssize_t len; - char *str_next, *str_roof; - - /* pack strings */ - str_next = (char *)msg->string; - str_roof = (char *)&msg->string[sizeof(msg->string)]; - - if (!pack_str(&msg->name, &str_next, &str_roof) - || !pack_str(&msg->left.id, &str_next, &str_roof) - || !pack_str(&msg->left.cert, &str_next, &str_roof) - || !pack_str(&msg->left.ca, &str_next, &str_roof) - || !pack_str(&msg->left.groups, &str_next, &str_roof) - || !pack_str(&msg->left.updown, &str_next, &str_roof) - || !pack_str(&msg->left.virt, &str_next, &str_roof) - || !pack_str(&msg->right.id, &str_next, &str_roof) - || !pack_str(&msg->right.cert, &str_next, &str_roof) - || !pack_str(&msg->right.ca, &str_next, &str_roof) - || !pack_str(&msg->right.groups, &str_next, &str_roof) - || !pack_str(&msg->right.updown, &str_next, &str_roof) - || !pack_str(&msg->right.virt, &str_next, &str_roof) - || !pack_str(&msg->keyid, &str_next, &str_roof) - || !pack_str(&msg->myid, &str_next, &str_roof) - || !pack_str(&msg->cacert, &str_next, &str_roof) - || !pack_str(&msg->ldaphost, &str_next, &str_roof) - || !pack_str(&msg->ldapbase, &str_next, &str_roof) - || !pack_str(&msg->crluri, &str_next, &str_roof) - || !pack_str(&msg->crluri2, &str_next, &str_roof) - || !pack_str(&msg->ocspuri, &str_next, &str_roof) - || !pack_str(&msg->ike, &str_next, &str_roof) - || !pack_str(&msg->esp, &str_next, &str_roof) - || !pack_str(&msg->sc_data, &str_next, &str_roof) - || (str_roof - str_next < msg->keyval.len)) - { - plog("send_wack_msg(): can't pack strings"); - return -1; - } - if (msg->keyval.ptr) - memcpy(str_next, msg->keyval.ptr, msg->keyval.len); - msg->keyval.ptr = NULL; - str_next += msg->keyval.len; - len = str_next - (char *)msg; - - /* connect to pluto ctl */ - sock = socket(AF_UNIX, SOCK_STREAM, 0); - if (sock < 0) - { - plog("socket() failed: %s", strerror(errno)); - return -1; - } - if (connect(sock, (struct sockaddr *)&ctl_addr, - offsetof(struct sockaddr_un, sun_path) + strlen(ctl_addr.sun_path)) < 0) - { - plog("connect(pluto_ctl) failed: %s", strerror(errno)); - close(sock); - return -1; - } + struct sockaddr_un ctl_addr; + int sock; + ssize_t len; + char *str_next, *str_roof; + + ctl_addr.sun_family = AF_UNIX; + strcpy(ctl_addr.sun_path, PLUTO_CTL_FILE); + + /* pack strings */ + str_next = (char *)msg->string; + str_roof = (char *)&msg->string[sizeof(msg->string)]; + + if (!pack_str(&msg->name, &str_next, &str_roof) + || !pack_str(&msg->left.id, &str_next, &str_roof) + || !pack_str(&msg->left.cert, &str_next, &str_roof) + || !pack_str(&msg->left.ca, &str_next, &str_roof) + || !pack_str(&msg->left.groups, &str_next, &str_roof) + || !pack_str(&msg->left.updown, &str_next, &str_roof) + || !pack_str(&msg->left.virt, &str_next, &str_roof) + || !pack_str(&msg->right.id, &str_next, &str_roof) + || !pack_str(&msg->right.cert, &str_next, &str_roof) + || !pack_str(&msg->right.ca, &str_next, &str_roof) + || !pack_str(&msg->right.groups, &str_next, &str_roof) + || !pack_str(&msg->right.updown, &str_next, &str_roof) + || !pack_str(&msg->right.virt, &str_next, &str_roof) + || !pack_str(&msg->keyid, &str_next, &str_roof) + || !pack_str(&msg->myid, &str_next, &str_roof) + || !pack_str(&msg->cacert, &str_next, &str_roof) + || !pack_str(&msg->ldaphost, &str_next, &str_roof) + || !pack_str(&msg->ldapbase, &str_next, &str_roof) + || !pack_str(&msg->crluri, &str_next, &str_roof) + || !pack_str(&msg->crluri2, &str_next, &str_roof) + || !pack_str(&msg->ocspuri, &str_next, &str_roof) + || !pack_str(&msg->ike, &str_next, &str_roof) + || !pack_str(&msg->esp, &str_next, &str_roof) + || !pack_str(&msg->sc_data, &str_next, &str_roof) + || (str_roof - str_next < msg->keyval.len)) + { + plog("send_wack_msg(): can't pack strings"); + return -1; + } + if (msg->keyval.ptr) + memcpy(str_next, msg->keyval.ptr, msg->keyval.len); + msg->keyval.ptr = NULL; + str_next += msg->keyval.len; + len = str_next - (char *)msg; + + /* connect to pluto ctl */ + sock = socket(AF_UNIX, SOCK_STREAM, 0); + if (sock < 0) + { + plog("socket() failed: %s", strerror(errno)); + return -1; + } + if (connect(sock, (struct sockaddr *)&ctl_addr, + offsetof(struct sockaddr_un, sun_path) + strlen(ctl_addr.sun_path)) < 0) + { + plog("connect(pluto_ctl) failed: %s", strerror(errno)); + close(sock); + return -1; + } - /* send message */ - if (write(sock, msg, len) != len) - { - plog("write(pluto_ctl) failed: %s", strerror(errno)); - close(sock); - return -1; - } + /* send message */ + if (write(sock, msg, len) != len) + { + plog("write(pluto_ctl) failed: %s", strerror(errno)); + close(sock); + return -1; + } - /* TODO: read reply */ - close(sock); - return 0; + /* TODO: read reply */ + close(sock); + return 0; } static void init_whack_msg(whack_message_t *msg) { - memset(msg, 0, sizeof(whack_message_t)); - msg->magic = WHACK_MAGIC; + memset(msg, 0, sizeof(whack_message_t)); + msg->magic = WHACK_MAGIC; } static char * connection_name(starter_conn_t *conn) { - /* if connection name is '%auto', create a new name like conn_xxxxx */ - static char buf[32]; - - if (streq(conn->name, "%auto")) - { - sprintf(buf, "conn_%ld", conn->id); - return buf; - } - return conn->name; + /* if connection name is '%auto', create a new name like conn_xxxxx */ + static char buf[32]; + + if (streq(conn->name, "%auto")) + { + sprintf(buf, "conn_%ld", conn->id); + return buf; + } + return conn->name; } static void set_whack_end(whack_end_t *w, starter_end_t *end, sa_family_t family) { - if (end->srcip && end->srcip[0] != '%') - { - int len = 0; - char *pos; + if (end->srcip && end->srcip[0] != '%') + { + int len = 0; + char *pos; + + pos = strchr(end->srcip, '/'); + if (pos) + { + /* use first address only for pluto */ + len = pos - end->srcip; + } + w->has_srcip = !end->has_natip; + ttoaddr(end->srcip, len, ip_version(end->srcip), &w->host_srcip); + } + else + { + anyaddr(AF_INET, &w->host_srcip); + } + + w->id = end->id; + w->cert = end->cert; + w->ca = end->ca; + w->groups = end->groups; + w->host_addr = end->addr; + w->has_client = end->has_client; + + if (family == AF_INET6 && isanyaddr(&end->nexthop)) + { + anyaddr(AF_INET6, &end->nexthop); + } + w->host_nexthop = end->nexthop; - pos = strchr(end->srcip, '/'); - if (pos) + if (w->has_client) { - /* use first address only for pluto */ - len = pos - end->srcip; + char *pos; + int len = 0; + + pos = strchr(end->subnet, ','); + if (pos) + { + len = pos - end->subnet; + } + ttosubnet(end->subnet, len, ip_version(end->subnet), &w->client); } - w->has_srcip = !end->has_natip; - ttoaddr(end->srcip, len, ip_version(end->srcip), &w->host_srcip); - } - else - { - anyaddr(AF_INET, &w->host_srcip); - } - - w->id = end->id; - w->cert = end->cert; - w->ca = end->ca; - w->groups = end->groups; - w->host_addr = end->addr; - w->has_client = end->has_client; - - if (family == AF_INET6 && isanyaddr(&end->nexthop)) - { - anyaddr(AF_INET6, &end->nexthop); - } - w->host_nexthop = end->nexthop; - - if (w->has_client) - { - char *pos; - int len = 0; - - pos = strchr(end->subnet, ','); - if (pos) + else { - len = pos - end->subnet; + if (end->has_virt) + { + w->virt = end->subnet; + } + w->client.addr.u.v4.sin_family = addrtypeof(&w->host_addr); } - ttosubnet(end->subnet, len, ip_version(end->subnet), &w->client); - } - else - { - if (end->has_virt) + + w->has_client_wildcard = end->has_client_wildcard; + w->has_port_wildcard = end->has_port_wildcard; + w->has_natip = end->has_natip; + w->allow_any = end->allow_any && !end->dns_failed; + w->modecfg = end->modecfg; + w->hostaccess = end->hostaccess; + w->sendcert = end->sendcert; + w->updown = end->updown; + w->host_port = IKE_UDP_PORT; + w->port = end->port; + w->protocol = end->protocol; + + if (w->port != 0) { - w->virt = end->subnet; + int port = htons(w->port); + + setportof(port, &w->host_addr); + setportof(port, &w->client.addr); } - w->client.addr.u.v4.sin_family = addrtypeof(&w->host_addr); - } - - w->has_client_wildcard = end->has_client_wildcard; - w->has_port_wildcard = end->has_port_wildcard; - w->has_natip = end->has_natip; - w->allow_any = end->allow_any && !end->dns_failed; - w->modecfg = end->modecfg; - w->hostaccess = end->hostaccess; - w->sendcert = end->sendcert; - w->updown = end->updown; - w->host_port = IKE_UDP_PORT; - w->port = end->port; - w->protocol = end->protocol; - - if (w->port != 0) - { - int port = htons(w->port); - - setportof(port, &w->host_addr); - setportof(port, &w->client.addr); - } } static int starter_whack_add_pubkey (starter_conn_t *conn, starter_end_t *end , const char *lr) { - const char *err; - static char keyspace[1024 + 4]; - whack_message_t msg; - - init_whack_msg(&msg); - - msg.whack_key = TRUE; - msg.pubkey_alg = PUBKEY_ALG_RSA; - if (end->id && end->rsakey) - { - /* special values to ignore */ - if (streq(end->rsakey, "") - || streq(end->rsakey, "%none") - || streq(end->rsakey, "%cert") - || streq(end->rsakey, "0x00")) - { - return 0; - } - msg.keyid = end->id; - err = atobytes(end->rsakey, 0, keyspace, sizeof(keyspace), &msg.keyval.len); - if (err) - { - plog("conn %s/%s: rsakey malformed [%s]", connection_name(conn), lr, err); - return 1; - } - else + const char *err; + static char keyspace[1024 + 4]; + whack_message_t msg; + + init_whack_msg(&msg); + + msg.whack_key = TRUE; + msg.pubkey_alg = PUBKEY_ALG_RSA; + if (end->id && end->rsakey) { - msg.keyval.ptr = keyspace; - return send_whack_msg(&msg); + /* special values to ignore */ + if (streq(end->rsakey, "") + || streq(end->rsakey, "%none") + || streq(end->rsakey, "%cert") + || streq(end->rsakey, "0x00")) + { + return 0; + } + msg.keyid = end->id; + err = atobytes(end->rsakey, 0, keyspace, sizeof(keyspace), &msg.keyval.len); + if (err) + { + plog("conn %s/%s: rsakey malformed [%s]", connection_name(conn), lr, err); + return 1; + } + else + { + msg.keyval.ptr = keyspace; + return send_whack_msg(&msg); + } } - } - return 0; + return 0; } int starter_whack_add_conn(starter_conn_t *conn) { - whack_message_t msg; - int r; - - init_whack_msg(&msg); - - msg.whack_connection = TRUE; - msg.name = connection_name(conn); - - msg.ikev1 = conn->keyexchange != KEY_EXCHANGE_IKEV2; - msg.addr_family = conn->addr_family; - msg.tunnel_addr_family = conn->tunnel_addr_family; - msg.sa_ike_life_seconds = conn->sa_ike_life_seconds; - msg.sa_ipsec_life_seconds = conn->sa_ipsec_life_seconds; - msg.sa_rekey_margin = conn->sa_rekey_margin; - msg.sa_rekey_fuzz = conn->sa_rekey_fuzz; - msg.sa_keying_tries = conn->sa_keying_tries; - msg.policy = conn->policy; - - /* - * Make sure the IKEv2-only policy bits are unset for IKEv1 connections - */ - msg.policy &= ~POLICY_DONT_REAUTH; - msg.policy &= ~POLICY_BEET; - msg.policy &= ~POLICY_MOBIKE; - msg.policy &= ~POLICY_FORCE_ENCAP; - - set_whack_end(&msg.left, &conn->left, conn->addr_family); - set_whack_end(&msg.right, &conn->right, conn->addr_family); - - msg.esp = conn->esp; - msg.ike = conn->ike; - msg.pfsgroup = conn->pfsgroup; - - /* taken from pluto/whack.c */ - if (msg.pfsgroup) - { - char esp_buf[256]; - - snprintf(esp_buf, sizeof (esp_buf), "%s;%s" - , msg.esp ? msg.esp : "" - , msg.pfsgroup ? msg.pfsgroup : ""); - msg.esp = esp_buf; - - DBG(DBG_CONTROL, - DBG_log("Setting --esp=%s", msg.esp) - ) - } - msg.dpd_delay = conn->dpd_delay; - msg.dpd_timeout = conn->dpd_timeout; - msg.dpd_action = conn->dpd_action; + whack_message_t msg; + int r; + + init_whack_msg(&msg); + + msg.whack_connection = TRUE; + msg.name = connection_name(conn); + + msg.ikev1 = conn->keyexchange != KEY_EXCHANGE_IKEV2; + msg.addr_family = conn->addr_family; + msg.tunnel_addr_family = conn->tunnel_addr_family; + msg.sa_ike_life_seconds = conn->sa_ike_life_seconds; + msg.sa_ipsec_life_seconds = conn->sa_ipsec_life_seconds; + msg.sa_rekey_margin = conn->sa_rekey_margin; + msg.sa_rekey_fuzz = conn->sa_rekey_fuzz; + msg.sa_keying_tries = conn->sa_keying_tries; + msg.policy = conn->policy; + + /* + * Make sure the IKEv2-only policy bits are unset for IKEv1 connections + */ + msg.policy &= ~POLICY_DONT_REAUTH; + msg.policy &= ~POLICY_BEET; + msg.policy &= ~POLICY_MOBIKE; + msg.policy &= ~POLICY_FORCE_ENCAP; + + set_whack_end(&msg.left, &conn->left, conn->addr_family); + set_whack_end(&msg.right, &conn->right, conn->addr_family); + + msg.esp = conn->esp; + msg.ike = conn->ike; + msg.pfsgroup = conn->pfsgroup; + + /* taken from pluto/whack.c */ + if (msg.pfsgroup) + { + char esp_buf[256]; + + snprintf(esp_buf, sizeof (esp_buf), "%s;%s" + , msg.esp ? msg.esp : "" + , msg.pfsgroup ? msg.pfsgroup : ""); + msg.esp = esp_buf; + + DBG(DBG_CONTROL, + DBG_log("Setting --esp=%s", msg.esp) + ) + } + msg.dpd_delay = conn->dpd_delay; + msg.dpd_timeout = conn->dpd_timeout; + msg.dpd_action = conn->dpd_action; /* msg.dpd_count = conn->dpd_count; not supported yet by strongSwan */ - r = send_whack_msg(&msg); + r = send_whack_msg(&msg); - if (r == 0 && (conn->policy & POLICY_RSASIG)) - { - r += starter_whack_add_pubkey (conn, &conn->left, "left"); - r += starter_whack_add_pubkey (conn, &conn->right, "right"); - } + if (r == 0 && (conn->policy & POLICY_PUBKEY)) + { + r += starter_whack_add_pubkey (conn, &conn->left, "left"); + r += starter_whack_add_pubkey (conn, &conn->right, "right"); + } - return r; + return r; } int starter_whack_del_conn(starter_conn_t *conn) { - whack_message_t msg; + whack_message_t msg; - init_whack_msg(&msg); - msg.whack_delete = TRUE; - msg.name = connection_name(conn); - return send_whack_msg(&msg); + init_whack_msg(&msg); + msg.whack_delete = TRUE; + msg.name = connection_name(conn); + return send_whack_msg(&msg); } int starter_whack_route_conn(starter_conn_t *conn) { - whack_message_t msg; + whack_message_t msg; - init_whack_msg(&msg); - msg.whack_route = TRUE; - msg.name = connection_name(conn); - return send_whack_msg(&msg); + init_whack_msg(&msg); + msg.whack_route = TRUE; + msg.name = connection_name(conn); + return send_whack_msg(&msg); } int starter_whack_initiate_conn(starter_conn_t *conn) { - whack_message_t msg; + whack_message_t msg; - init_whack_msg(&msg); - msg.whack_initiate = TRUE; - msg.whack_async = TRUE; - msg.name = connection_name(conn); - return send_whack_msg(&msg); + init_whack_msg(&msg); + msg.whack_initiate = TRUE; + msg.whack_async = TRUE; + msg.name = connection_name(conn); + return send_whack_msg(&msg); } int starter_whack_listen(void) { - whack_message_t msg; - init_whack_msg(&msg); - msg.whack_listen = TRUE; - return send_whack_msg(&msg); + whack_message_t msg; + init_whack_msg(&msg); + msg.whack_listen = TRUE; + return send_whack_msg(&msg); } int starter_whack_shutdown(void) { - whack_message_t msg; + whack_message_t msg; - init_whack_msg(&msg); - msg.whack_shutdown = TRUE; - return send_whack_msg(&msg); + init_whack_msg(&msg); + msg.whack_shutdown = TRUE; + return send_whack_msg(&msg); } int starter_whack_add_ca(starter_ca_t *ca) { - whack_message_t msg; + whack_message_t msg; - init_whack_msg(&msg); + init_whack_msg(&msg); - msg.whack_ca = TRUE; - msg.name = ca->name; - msg.cacert = ca->cacert; - msg.ldaphost = ca->ldaphost; - msg.ldapbase = ca->ldapbase; - msg.crluri = ca->crluri; - msg.crluri2 = ca->crluri2; - msg.ocspuri = ca->ocspuri; - msg.whack_strict = ca->strict; + msg.whack_ca = TRUE; + msg.name = ca->name; + msg.cacert = ca->cacert; + msg.ldaphost = ca->ldaphost; + msg.ldapbase = ca->ldapbase; + msg.crluri = ca->crluri; + msg.crluri2 = ca->crluri2; + msg.ocspuri = ca->ocspuri; + msg.whack_strict = ca->strict; - return send_whack_msg(&msg); + return send_whack_msg(&msg); } int starter_whack_del_ca(starter_ca_t *ca) { - whack_message_t msg; + whack_message_t msg; - init_whack_msg(&msg); + init_whack_msg(&msg); - msg.whack_delete = TRUE; - msg.whack_ca = TRUE; - msg.name = ca->name; + msg.whack_delete = TRUE; + msg.whack_ca = TRUE; + msg.name = ca->name; - return send_whack_msg(&msg); + return send_whack_msg(&msg); } diff --git a/src/starter/starterwhack.h b/src/starter/starterwhack.h index 7acc75ec0..d56b02421 100644 --- a/src/starter/starterwhack.h +++ b/src/starter/starterwhack.h @@ -10,8 +10,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: starterwhack.h 3267 2007-10-08 19:57:54Z andreas $ */ #ifndef _STARTER_WHACK_H_ diff --git a/src/starter/y.tab.c b/src/starter/y.tab.c index 87abc5c33..b78c1b1f9 100644 --- a/src/starter/y.tab.c +++ b/src/starter/y.tab.c @@ -94,7 +94,7 @@ /* Copy the first part of user declarations. */ -#line 1 "parser.y" +#line 1 "./parser.y" /* strongSwan config file parser (parser.y) * Copyright (C) 2001 Mathieu Lafon - Arkoon Network Security @@ -108,8 +108,6 @@ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. - * - * RCSID $Id: parser.y 3267 2007-10-08 19:57:54Z andreas $ */ #include <stdio.h> @@ -124,7 +122,7 @@ #include "parser.h" #define YYERROR_VERBOSE -#define ERRSTRING_LEN 256 +#define ERRSTRING_LEN 256 /** * Bison @@ -170,10 +168,10 @@ extern kw_entry_t *in_word_set (char *str, unsigned int len); #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED typedef union YYSTYPE -#line 56 "parser.y" +#line 54 "./parser.y" { char *s; } /* Line 187 of yacc.c. */ -#line 177 "y.tab.c" +#line 175 "y.tab.c" YYSTYPE; # define yystype YYSTYPE /* obsolescent; will be withdrawn */ # define YYSTYPE_IS_DECLARED 1 @@ -186,7 +184,7 @@ typedef union YYSTYPE /* Line 216 of yacc.c. */ -#line 190 "y.tab.c" +#line 188 "y.tab.c" #ifdef short # undef short @@ -474,8 +472,8 @@ static const yytype_int8 yyrhs[] = /* YYRLINE[YYN] -- source line where rule number YYN was defined. */ static const yytype_uint8 yyrline[] = { - 0, 67, 67, 68, 72, 77, 76, 82, 81, 99, - 98, 115, 114, 120, 124, 125, 129, 154, 158 + 0, 65, 65, 66, 70, 75, 74, 80, 79, 96, + 95, 111, 110, 116, 120, 121, 125, 150, 154 }; #endif @@ -1390,106 +1388,104 @@ yyreduce: switch (yyn) { case 4: -#line 73 "parser.y" +#line 71 "./parser.y" { - free((yyvsp[(2) - (3)].s)); - } + free((yyvsp[(2) - (3)].s)); + } break; case 5: -#line 77 "parser.y" +#line 75 "./parser.y" { - _parser_kw = &(_parser_cfg->config_setup); - _parser_kw_last = NULL; - } + _parser_kw = &(_parser_cfg->config_setup); + _parser_kw_last = NULL; + } break; case 7: -#line 82 "parser.y" +#line 80 "./parser.y" { - section_list_t *section = (section_list_t *)alloc_thing(section_list_t - , "section_list_t"); - - section->name = clone_str((yyvsp[(2) - (3)].s), "conn section name"); - section->kw = NULL; - section->next = NULL; - _parser_kw = &(section->kw); - if (!_parser_cfg->conn_first) - _parser_cfg->conn_first = section; - if (_parser_cfg->conn_last) - _parser_cfg->conn_last->next = section; - _parser_cfg->conn_last = section; - _parser_kw_last = NULL; - free((yyvsp[(2) - (3)].s)); - } + section_list_t *section = malloc_thing(section_list_t); + + section->name = clone_str((yyvsp[(2) - (3)].s)); + section->kw = NULL; + section->next = NULL; + _parser_kw = &(section->kw); + if (!_parser_cfg->conn_first) + _parser_cfg->conn_first = section; + if (_parser_cfg->conn_last) + _parser_cfg->conn_last->next = section; + _parser_cfg->conn_last = section; + _parser_kw_last = NULL; + free((yyvsp[(2) - (3)].s)); + } break; case 9: -#line 99 "parser.y" +#line 96 "./parser.y" { - section_list_t *section = (section_list_t *)alloc_thing(section_list_t - , "section_list_t"); - section->name = clone_str((yyvsp[(2) - (3)].s), "ca section name"); - section->kw = NULL; - section->next = NULL; - _parser_kw = &(section->kw); - if (!_parser_cfg->ca_first) - _parser_cfg->ca_first = section; - if (_parser_cfg->ca_last) - _parser_cfg->ca_last->next = section; - _parser_cfg->ca_last = section; - _parser_kw_last = NULL; - free((yyvsp[(2) - (3)].s)); - } + section_list_t *section = malloc_thing(section_list_t); + section->name = clone_str((yyvsp[(2) - (3)].s)); + section->kw = NULL; + section->next = NULL; + _parser_kw = &(section->kw); + if (!_parser_cfg->ca_first) + _parser_cfg->ca_first = section; + if (_parser_cfg->ca_last) + _parser_cfg->ca_last->next = section; + _parser_cfg->ca_last = section; + _parser_kw_last = NULL; + free((yyvsp[(2) - (3)].s)); + } break; case 11: -#line 115 "parser.y" +#line 111 "./parser.y" { - extern void _parser_y_include (const char *f); - _parser_y_include((yyvsp[(2) - (2)].s)); - free((yyvsp[(2) - (2)].s)); - } + extern void _parser_y_include (const char *f); + _parser_y_include((yyvsp[(2) - (2)].s)); + free((yyvsp[(2) - (2)].s)); + } break; case 16: -#line 130 "parser.y" +#line 126 "./parser.y" { - kw_list_t *new; - kw_entry_t *entry = in_word_set((yyvsp[(1) - (3)].s), strlen((yyvsp[(1) - (3)].s))); + kw_list_t *new; + kw_entry_t *entry = in_word_set((yyvsp[(1) - (3)].s), strlen((yyvsp[(1) - (3)].s))); - if (entry == NULL) - { - snprintf(errbuf, ERRSTRING_LEN, "unknown keyword '%s'", (yyvsp[(1) - (3)].s)); - yyerror(errbuf); - } - else if (_parser_kw) - { - new = (kw_list_t *)alloc_thing(kw_list_t, "kw_list_t"); - new->entry = entry; - new->value = clone_str((yyvsp[(3) - (3)].s), "kw_list value"); - new->next = NULL; - if (_parser_kw_last) - _parser_kw_last->next = new; - _parser_kw_last = new; - if (!*_parser_kw) - *_parser_kw = new; + if (entry == NULL) + { + snprintf(errbuf, ERRSTRING_LEN, "unknown keyword '%s'", (yyvsp[(1) - (3)].s)); + yyerror(errbuf); + } + else if (_parser_kw) + { + new = (kw_list_t *)malloc_thing(kw_list_t); + new->entry = entry; + new->value = clone_str((yyvsp[(3) - (3)].s)); + new->next = NULL; + if (_parser_kw_last) + _parser_kw_last->next = new; + _parser_kw_last = new; + if (!*_parser_kw) + *_parser_kw = new; + } + free((yyvsp[(1) - (3)].s)); + free((yyvsp[(3) - (3)].s)); } - free((yyvsp[(1) - (3)].s)); - free((yyvsp[(3) - (3)].s)); - } break; case 17: -#line 155 "parser.y" +#line 151 "./parser.y" { - free((yyvsp[(1) - (2)].s)); - } + free((yyvsp[(1) - (2)].s)); + } break; /* Line 1267 of yacc.c. */ -#line 1493 "y.tab.c" +#line 1489 "y.tab.c" default: break; } YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc); @@ -1703,128 +1699,125 @@ yyreturn: } -#line 161 "parser.y" +#line 157 "./parser.y" void yyerror(const char *s) { - if (_save_errors_) - _parser_y_error(parser_errstring, ERRSTRING_LEN, s); + if (_save_errors_) + _parser_y_error(parser_errstring, ERRSTRING_LEN, s); } config_parsed_t * parser_load_conf(const char *file) { - config_parsed_t *cfg = NULL; - int err = 0; - FILE *f; + config_parsed_t *cfg = NULL; + int err = 0; + FILE *f; - extern void _parser_y_init (const char *f); - extern FILE *yyin; + extern void _parser_y_init (const char *f); + extern FILE *yyin; - memset(parser_errstring, 0, ERRSTRING_LEN+1); + memset(parser_errstring, 0, ERRSTRING_LEN+1); - cfg = (config_parsed_t *)alloc_thing(config_parsed_t, "config_parsed_t"); - if (cfg) - { - memset(cfg, 0, sizeof(config_parsed_t)); - f = fopen(file, "r"); - if (f) + cfg = (config_parsed_t *)malloc_thing(config_parsed_t); + if (cfg) { - yyin = f; - _parser_y_init(file); - _save_errors_ = 1; - _parser_cfg = cfg; - - if (yyparse() !=0 ) - { - if (parser_errstring[0] == '\0') + memset(cfg, 0, sizeof(config_parsed_t)); + f = fopen(file, "r"); + if (f) { - snprintf(parser_errstring, ERRSTRING_LEN, "Unknown error..."); + yyin = f; + _parser_y_init(file); + _save_errors_ = 1; + _parser_cfg = cfg; + + if (yyparse() !=0 ) + { + if (parser_errstring[0] == '\0') + { + snprintf(parser_errstring, ERRSTRING_LEN, "Unknown error..."); + } + _save_errors_ = 0; + while (yyparse() != 0); + err++; + } + else if (parser_errstring[0] != '\0') + { + err++; + } + else + { + /** + * Config valid + */ + } + + fclose(f); + } + else + { + snprintf(parser_errstring, ERRSTRING_LEN, "can't load file '%s'", file); + err++; } - _save_errors_ = 0; - while (yyparse() != 0); - err++; - } - else if (parser_errstring[0] != '\0') - { - err++; - } - else - { - /** - * Config valid - */ - } - - fclose(f); } else { - snprintf(parser_errstring, ERRSTRING_LEN, "can't load file '%s'", file); - err++; + snprintf(parser_errstring, ERRSTRING_LEN, "can't allocate memory"); + err++; } - } - else - { - snprintf(parser_errstring, ERRSTRING_LEN, "can't allocate memory"); - err++; - } - if (err) - { - plog("%s", parser_errstring); + if (err) + { + plog("%s", parser_errstring); - if (cfg) - parser_free_conf(cfg); - cfg = NULL; - } + if (cfg) + parser_free_conf(cfg); + cfg = NULL; + } - return cfg; + return cfg; } static void parser_free_kwlist(kw_list_t *list) { - kw_list_t *elt; + kw_list_t *elt; - while (list) - { - elt = list; - list = list->next; - if (elt->value) - pfree(elt->value); - pfree(elt); - } + while (list) + { + elt = list; + list = list->next; + free(elt->value); + free(elt); + } } void parser_free_conf(config_parsed_t *cfg) { - section_list_t *sec; - if (cfg) - { - parser_free_kwlist(cfg->config_setup); - while (cfg->conn_first) - { - sec = cfg->conn_first; - cfg->conn_first = cfg->conn_first->next; - if (sec->name) - pfree(sec->name); - parser_free_kwlist(sec->kw); - pfree(sec); - } - while (cfg->ca_first) + section_list_t *sec; + if (cfg) { - sec = cfg->ca_first; - cfg->ca_first = cfg->ca_first->next; - if (sec->name) - pfree(sec->name); - parser_free_kwlist(sec->kw); - pfree(sec); + parser_free_kwlist(cfg->config_setup); + while (cfg->conn_first) + { + sec = cfg->conn_first; + cfg->conn_first = cfg->conn_first->next; + free(sec->name); + parser_free_kwlist(sec->kw); + free(sec); + } + while (cfg->ca_first) + { + sec = cfg->ca_first; + cfg->ca_first = cfg->ca_first->next; + free(sec->name); + parser_free_kwlist(sec->kw); + free(sec); + } + free(cfg); } - pfree(cfg); - } } diff --git a/src/starter/y.tab.h b/src/starter/y.tab.h index 1cf56de3a..871de1e97 100644 --- a/src/starter/y.tab.h +++ b/src/starter/y.tab.h @@ -68,7 +68,7 @@ #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED typedef union YYSTYPE -#line 56 "parser.y" +#line 54 "./parser.y" { char *s; } /* Line 1489 of yacc.c. */ #line 75 "y.tab.h" |