X-Git-Url: https://www.tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fnet_setup.c;h=c033e22004564827aae5e447f98a6090d1a292bf;hb=92d66492e0824674f68d26e787dd1ba4444a4601;hp=118d719c439d4420e023915c0406686973c9c45f;hpb=9f53ab209d8a6a7622a49ed03cef735b6e3f3eeb;p=tinc diff --git a/src/net_setup.c b/src/net_setup.c index 118d719c..17675aec 100644 --- a/src/net_setup.c +++ b/src/net_setup.c @@ -1,8 +1,9 @@ /* net_setup.c -- Setup. Copyright (C) 1998-2005 Ivo Timmermans, - 2000-2010 Guus Sliepen + 2000-2017 Guus Sliepen 2006 Scott Lamb + 2010 Brandon Black This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -21,488 +22,999 @@ #include "system.h" -#include -#include -#include -#include -#include - -#include "avl_tree.h" +#include "cipher.h" #include "conf.h" #include "connection.h" +#include "control.h" #include "device.h" -#include "event.h" +#include "digest.h" +#include "ecdsa.h" #include "graph.h" #include "logger.h" +#include "names.h" #include "net.h" #include "netutl.h" #include "process.h" #include "protocol.h" #include "route.h" +#include "rsa.h" +#include "script.h" #include "subnet.h" #include "utils.h" #include "xalloc.h" +#ifdef HAVE_MINIUPNPC +#include "upnp.h" +#endif + char *myport; +static io_t device_io; +devops_t devops; +bool device_standby = false; + +char *proxyhost; +char *proxyport; +char *proxyuser; +char *proxypass; +proxytype_t proxytype; +bool autoconnect; +bool disablebuggypeers; + +char *scriptinterpreter; +char *scriptextension; + +bool node_read_ecdsa_public_key(node_t *n) { + if(ecdsa_active(n->ecdsa)) { + return true; + } -bool read_rsa_public_key(connection_t *c) { + splay_tree_t *config_tree; FILE *fp; - char *fname; - char *key; + char *pubname = NULL; + char *p; + + init_configuration(&config_tree); - if(!c->rsa_key) { - c->rsa_key = RSA_new(); -// RSA_blinding_on(c->rsa_key, NULL); + if(!read_host_config(config_tree, n->name, true)) { + goto exit; } - /* First, check for simple PublicKey statement */ + /* First, check for simple Ed25519PublicKey statement */ + + if(get_config_string(lookup_config(config_tree, "Ed25519PublicKey"), &p)) { + n->ecdsa = ecdsa_set_base64_public_key(p); + free(p); + goto exit; + } + + /* Else, check for Ed25519PublicKeyFile statement and read it */ + + if(!get_config_string(lookup_config(config_tree, "Ed25519PublicKeyFile"), &pubname)) { + xasprintf(&pubname, "%s" SLASH "hosts" SLASH "%s", confbase, n->name); + } + + fp = fopen(pubname, "r"); + + if(!fp) { + goto exit; + } + + n->ecdsa = ecdsa_read_pem_public_key(fp); + fclose(fp); + +exit: + exit_configuration(&config_tree); + free(pubname); + return n->ecdsa; +} - if(get_config_string(lookup_config(c->config_tree, "PublicKey"), &key)) { - BN_hex2bn(&c->rsa_key->n, key); - BN_hex2bn(&c->rsa_key->e, "FFFF"); - free(key); +bool read_ecdsa_public_key(connection_t *c) { + if(ecdsa_active(c->ecdsa)) { return true; } - /* Else, check for PublicKeyFile statement and read it */ + FILE *fp; + char *fname; + char *p; - if(get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &fname)) { - fp = fopen(fname, "r"); + if(!c->config_tree) { + init_configuration(&c->config_tree); - if(!fp) { - logger(LOG_ERR, "Error reading RSA public key file `%s': %s", - fname, strerror(errno)); - free(fname); + if(!read_host_config(c->config_tree, c->name, true)) { return false; } + } + + /* First, check for simple Ed25519PublicKey statement */ + if(get_config_string(lookup_config(c->config_tree, "Ed25519PublicKey"), &p)) { + c->ecdsa = ecdsa_set_base64_public_key(p); + free(p); + return c->ecdsa; + } + + /* Else, check for Ed25519PublicKeyFile statement and read it */ + + if(!get_config_string(lookup_config(c->config_tree, "Ed25519PublicKeyFile"), &fname)) { + xasprintf(&fname, "%s" SLASH "hosts" SLASH "%s", confbase, c->name); + } + + fp = fopen(fname, "r"); + + if(!fp) { + logger(DEBUG_ALWAYS, LOG_ERR, "Error reading Ed25519 public key file `%s': %s", + fname, strerror(errno)); free(fname); - c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL); - fclose(fp); + return false; + } - if(c->rsa_key) - return true; /* Woohoo. */ + c->ecdsa = ecdsa_read_pem_public_key(fp); - /* If it fails, try PEM_read_RSA_PUBKEY. */ - fp = fopen(fname, "r"); + if(!c->ecdsa && errno != ENOENT) { + logger(DEBUG_ALWAYS, LOG_ERR, "Parsing Ed25519 public key file `%s' failed.", fname); + } - if(!fp) { - logger(LOG_ERR, "Error reading RSA public key file `%s': %s", - fname, strerror(errno)); - free(fname); - return false; - } + fclose(fp); + free(fname); + return c->ecdsa; +} + +#ifndef DISABLE_LEGACY +bool read_rsa_public_key(connection_t *c) { + FILE *fp; + char *fname; + char *n; + + /* First, check for simple PublicKey statement */ + + if(get_config_string(lookup_config(c->config_tree, "PublicKey"), &n)) { + c->rsa = rsa_set_hex_public_key(n, "FFFF"); + free(n); + return c->rsa; + } + + /* Else, check for PublicKeyFile statement and read it */ + if(!get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &fname)) { + xasprintf(&fname, "%s" SLASH "hosts" SLASH "%s", confbase, c->name); + } + + fp = fopen(fname, "r"); + + if(!fp) { + logger(DEBUG_ALWAYS, LOG_ERR, "Error reading RSA public key file `%s': %s", fname, strerror(errno)); free(fname); - c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL); - fclose(fp); + return false; + } - if(c->rsa_key) { -// RSA_blinding_on(c->rsa_key, NULL); - return true; + c->rsa = rsa_read_pem_public_key(fp); + fclose(fp); + + if(!c->rsa) { + logger(DEBUG_ALWAYS, LOG_ERR, "Reading RSA public key file `%s' failed: %s", fname, strerror(errno)); + } + + free(fname); + return c->rsa; +} +#endif + +static bool read_ecdsa_private_key(void) { + FILE *fp; + char *fname; + + /* Check for PrivateKeyFile statement and read it */ + + if(!get_config_string(lookup_config(config_tree, "Ed25519PrivateKeyFile"), &fname)) { + xasprintf(&fname, "%s" SLASH "ed25519_key.priv", confbase); + } + + fp = fopen(fname, "r"); + + if(!fp) { + logger(DEBUG_ALWAYS, LOG_ERR, "Error reading Ed25519 private key file `%s': %s", fname, strerror(errno)); + + if(errno == ENOENT) { + logger(DEBUG_ALWAYS, LOG_INFO, "Create an Ed25519 keypair with `tinc -n %s generate-ed25519-keys'.", netname ? : "."); } - logger(LOG_ERR, "Reading RSA public key file `%s' failed: %s", - fname, strerror(errno)); + free(fname); return false; } - /* Else, check if a harnessed public key is in the config file */ +#if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN) + struct stat s; - xasprintf(&fname, "%s/hosts/%s", confbase, c->name); - fp = fopen(fname, "r"); + if(fstat(fileno(fp), &s)) { + logger(DEBUG_ALWAYS, LOG_ERR, "Could not stat Ed25519 private key file `%s': %s'", fname, strerror(errno)); + free(fname); + return false; + } - if(fp) { - c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL); - fclose(fp); + if(s.st_mode & ~0100700) { + logger(DEBUG_ALWAYS, LOG_WARNING, "Warning: insecure file permissions for Ed25519 private key file `%s'!", fname); + } + +#endif + + myself->connection->ecdsa = ecdsa_read_pem_private_key(fp); + fclose(fp); + + if(!myself->connection->ecdsa) { + logger(DEBUG_ALWAYS, LOG_ERR, "Reading Ed25519 private key file `%s' failed", fname); } free(fname); + return myself->connection->ecdsa; +} - if(c->rsa_key) - return true; +static bool read_invitation_key(void) { + FILE *fp; + char fname[PATH_MAX]; + + if(invitation_key) { + ecdsa_free(invitation_key); + invitation_key = NULL; + } - /* Try again with PEM_read_RSA_PUBKEY. */ + snprintf(fname, sizeof(fname), "%s" SLASH "invitations" SLASH "ed25519_key.priv", confbase); - xasprintf(&fname, "%s/hosts/%s", confbase, c->name); fp = fopen(fname, "r"); if(fp) { - c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL); -// RSA_blinding_on(c->rsa_key, NULL); + invitation_key = ecdsa_read_pem_private_key(fp); fclose(fp); + + if(!invitation_key) { + logger(DEBUG_ALWAYS, LOG_ERR, "Reading Ed25519 private key file `%s' failed", fname); + } + } + + return invitation_key; +} + +#ifndef DISABLE_LEGACY +static bool read_rsa_private_key(void) { + FILE *fp; + char *fname; + char *n, *d; + + /* First, check for simple PrivateKey statement */ + + if(get_config_string(lookup_config(config_tree, "PrivateKey"), &d)) { + if(!get_config_string(lookup_config(config_tree, "PublicKey"), &n)) { + logger(DEBUG_ALWAYS, LOG_ERR, "PrivateKey used but no PublicKey found!"); + free(d); + return false; + } + + myself->connection->rsa = rsa_set_hex_private_key(n, "FFFF", d); + free(n); + free(d); + return myself->connection->rsa; + } + + /* Else, check for PrivateKeyFile statement and read it */ + + if(!get_config_string(lookup_config(config_tree, "PrivateKeyFile"), &fname)) { + xasprintf(&fname, "%s" SLASH "rsa_key.priv", confbase); + } + + fp = fopen(fname, "r"); + + if(!fp) { + logger(DEBUG_ALWAYS, LOG_ERR, "Error reading RSA private key file `%s': %s", + fname, strerror(errno)); + + if(errno == ENOENT) { + logger(DEBUG_ALWAYS, LOG_INFO, "Create an RSA keypair with `tinc -n %s generate-rsa-keys'.", netname ? : "."); + } + + free(fname); + return false; + } + +#if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN) + struct stat s; + + if(fstat(fileno(fp), &s)) { + logger(DEBUG_ALWAYS, LOG_ERR, "Could not stat RSA private key file `%s': %s'", fname, strerror(errno)); + free(fname); + return false; + } + + if(s.st_mode & ~0100700) { + logger(DEBUG_ALWAYS, LOG_WARNING, "Warning: insecure file permissions for RSA private key file `%s'!", fname); + } + +#endif + + myself->connection->rsa = rsa_read_pem_private_key(fp); + fclose(fp); + + if(!myself->connection->rsa) { + logger(DEBUG_ALWAYS, LOG_ERR, "Reading RSA private key file `%s' failed: %s", fname, strerror(errno)); } free(fname); + return myself->connection->rsa; +} +#endif - if(c->rsa_key) - return true; +static timeout_t keyexpire_timeout; + +static void keyexpire_handler(void *data) { + regenerate_key(); + timeout_set(data, &(struct timeval) { + keylifetime, rand() % 100000 + }); +} - logger(LOG_ERR, "No public key for %s specified!", c->name); +void regenerate_key(void) { + logger(DEBUG_STATUS, LOG_INFO, "Expiring symmetric keys"); + send_key_changed(); - return false; + for splay_each(node_t, n, node_tree) { + n->status.validkey_in = false; + } } -bool read_rsa_private_key(void) { - FILE *fp; - char *fname, *key, *pubkey; - struct stat s; +void load_all_nodes(void) { + DIR *dir; + struct dirent *ent; + char dname[PATH_MAX]; - if(get_config_string(lookup_config(config_tree, "PrivateKey"), &key)) { - if(!get_config_string(lookup_config(myself->connection->config_tree, "PublicKey"), &pubkey)) { - logger(LOG_ERR, "PrivateKey used but no PublicKey found!"); + snprintf(dname, sizeof(dname), "%s" SLASH "hosts", confbase); + dir = opendir(dname); + + if(!dir) { + logger(DEBUG_ALWAYS, LOG_ERR, "Could not open %s: %s", dname, strerror(errno)); + return; + } + + while((ent = readdir(dir))) { + if(!check_id(ent->d_name)) { + continue; + } + + node_t *n = lookup_node(ent->d_name); + + splay_tree_t *config_tree; + init_configuration(&config_tree); + read_config_options(config_tree, ent->d_name); + read_host_config(config_tree, ent->d_name, true); + + if(!n) { + n = new_node(); + n->name = xstrdup(ent->d_name); + node_add(n); + } + + if(strictsubnets) { + for(config_t *cfg = lookup_config(config_tree, "Subnet"); cfg; cfg = lookup_config_next(config_tree, cfg)) { + subnet_t *s, *s2; + + if(!get_config_subnet(cfg, &s)) { + continue; + } + + if((s2 = lookup_subnet(n, s))) { + s2->expires = -1; + free(s); + } else { + subnet_add(n, s); + } + } + } + + if(lookup_config(config_tree, "Address")) { + n->status.has_address = true; + } + + exit_configuration(&config_tree); + } + + closedir(dir); +} + +char *get_name(void) { + char *name = NULL; + char *returned_name; + + get_config_string(lookup_config(config_tree, "Name"), &name); + + if(!name) { + return NULL; + } + + returned_name = replace_name(name); + free(name); + return returned_name; +} + +bool setup_myself_reloadable(void) { + char *proxy = NULL; + char *rmode = NULL; + char *fmode = NULL; + char *bmode = NULL; + char *afname = NULL; + char *space; + bool choice; + + free(scriptinterpreter); + scriptinterpreter = NULL; + get_config_string(lookup_config(config_tree, "ScriptsInterpreter"), &scriptinterpreter); + + + free(scriptextension); + + if(!get_config_string(lookup_config(config_tree, "ScriptsExtension"), &scriptextension)) { + scriptextension = xstrdup(""); + } + + get_config_string(lookup_config(config_tree, "Proxy"), &proxy); + + if(proxy) { + if((space = strchr(proxy, ' '))) { + *space++ = 0; + } + + if(!strcasecmp(proxy, "none")) { + proxytype = PROXY_NONE; + } else if(!strcasecmp(proxy, "socks4")) { + proxytype = PROXY_SOCKS4; + } else if(!strcasecmp(proxy, "socks4a")) { + proxytype = PROXY_SOCKS4A; + } else if(!strcasecmp(proxy, "socks5")) { + proxytype = PROXY_SOCKS5; + } else if(!strcasecmp(proxy, "http")) { + proxytype = PROXY_HTTP; + } else if(!strcasecmp(proxy, "exec")) { + proxytype = PROXY_EXEC; + } else { + logger(DEBUG_ALWAYS, LOG_ERR, "Unknown proxy type %s!", proxy); return false; } - myself->connection->rsa_key = RSA_new(); -// RSA_blinding_on(myself->connection->rsa_key, NULL); - BN_hex2bn(&myself->connection->rsa_key->d, key); - BN_hex2bn(&myself->connection->rsa_key->n, pubkey); - BN_hex2bn(&myself->connection->rsa_key->e, "FFFF"); - free(key); - free(pubkey); - return true; + + switch(proxytype) { + case PROXY_NONE: + default: + break; + + case PROXY_EXEC: + if(!space || !*space) { + logger(DEBUG_ALWAYS, LOG_ERR, "Argument expected for proxy type exec!"); + return false; + } + + proxyhost = xstrdup(space); + break; + + case PROXY_SOCKS4: + case PROXY_SOCKS4A: + case PROXY_SOCKS5: + case PROXY_HTTP: + proxyhost = space; + + if(space && (space = strchr(space, ' '))) { + *space++ = 0, proxyport = space; + } + + if(space && (space = strchr(space, ' '))) { + *space++ = 0, proxyuser = space; + } + + if(space && (space = strchr(space, ' '))) { + *space++ = 0, proxypass = space; + } + + if(!proxyhost || !*proxyhost || !proxyport || !*proxyport) { + logger(DEBUG_ALWAYS, LOG_ERR, "Host and port argument expected for proxy!"); + return false; + } + + proxyhost = xstrdup(proxyhost); + proxyport = xstrdup(proxyport); + + if(proxyuser && *proxyuser) { + proxyuser = xstrdup(proxyuser); + } + + if(proxypass && *proxypass) { + proxypass = xstrdup(proxypass); + } + + break; + } + + free(proxy); + } + + if(get_config_bool(lookup_config(config_tree, "IndirectData"), &choice) && choice) { + myself->options |= OPTION_INDIRECT; + } + + if(get_config_bool(lookup_config(config_tree, "TCPOnly"), &choice) && choice) { + myself->options |= OPTION_TCPONLY; + } + + if(myself->options & OPTION_TCPONLY) { + myself->options |= OPTION_INDIRECT; + } + + get_config_bool(lookup_config(config_tree, "UDPDiscovery"), &udp_discovery); + get_config_int(lookup_config(config_tree, "UDPDiscoveryKeepaliveInterval"), &udp_discovery_keepalive_interval); + get_config_int(lookup_config(config_tree, "UDPDiscoveryInterval"), &udp_discovery_interval); + get_config_int(lookup_config(config_tree, "UDPDiscoveryTimeout"), &udp_discovery_timeout); + + get_config_int(lookup_config(config_tree, "MTUInfoInterval"), &mtu_info_interval); + get_config_int(lookup_config(config_tree, "UDPInfoInterval"), &udp_info_interval); + + get_config_bool(lookup_config(config_tree, "DirectOnly"), &directonly); + get_config_bool(lookup_config(config_tree, "LocalDiscovery"), &localdiscovery); + + if(get_config_string(lookup_config(config_tree, "Mode"), &rmode)) { + if(!strcasecmp(rmode, "router")) { + routing_mode = RMODE_ROUTER; + } else if(!strcasecmp(rmode, "switch")) { + routing_mode = RMODE_SWITCH; + } else if(!strcasecmp(rmode, "hub")) { + routing_mode = RMODE_HUB; + } else { + logger(DEBUG_ALWAYS, LOG_ERR, "Invalid routing mode!"); + return false; + } + + free(rmode); + } + + if(get_config_string(lookup_config(config_tree, "Forwarding"), &fmode)) { + if(!strcasecmp(fmode, "off")) { + forwarding_mode = FMODE_OFF; + } else if(!strcasecmp(fmode, "internal")) { + forwarding_mode = FMODE_INTERNAL; + } else if(!strcasecmp(fmode, "kernel")) { + forwarding_mode = FMODE_KERNEL; + } else { + logger(DEBUG_ALWAYS, LOG_ERR, "Invalid forwarding mode!"); + return false; + } + + free(fmode); + } + + choice = !(myself->options & OPTION_TCPONLY); + get_config_bool(lookup_config(config_tree, "PMTUDiscovery"), &choice); + + if(choice) { + myself->options |= OPTION_PMTU_DISCOVERY; + } + + choice = true; + get_config_bool(lookup_config(config_tree, "ClampMSS"), &choice); + + if(choice) { + myself->options |= OPTION_CLAMP_MSS; + } + + get_config_bool(lookup_config(config_tree, "PriorityInheritance"), &priorityinheritance); + get_config_bool(lookup_config(config_tree, "DecrementTTL"), &decrement_ttl); + + if(get_config_string(lookup_config(config_tree, "Broadcast"), &bmode)) { + if(!strcasecmp(bmode, "no")) { + broadcast_mode = BMODE_NONE; + } else if(!strcasecmp(bmode, "yes") || !strcasecmp(bmode, "mst")) { + broadcast_mode = BMODE_MST; + } else if(!strcasecmp(bmode, "direct")) { + broadcast_mode = BMODE_DIRECT; + } else { + logger(DEBUG_ALWAYS, LOG_ERR, "Invalid broadcast mode!"); + return false; + } + + free(bmode); } - if(!get_config_string(lookup_config(config_tree, "PrivateKeyFile"), &fname)) - xasprintf(&fname, "%s/rsa_key.priv", confbase); + const char *const DEFAULT_BROADCAST_SUBNETS[] = { "ff:ff:ff:ff:ff:ff", "255.255.255.255", "224.0.0.0/4", "ff00::/8" }; + + for(size_t i = 0; i < sizeof(DEFAULT_BROADCAST_SUBNETS) / sizeof(*DEFAULT_BROADCAST_SUBNETS); i++) { + subnet_t *s = new_subnet(); + + if(!str2net(s, DEFAULT_BROADCAST_SUBNETS[i])) { + abort(); + } + + subnet_add(NULL, s); + } + + for(config_t *cfg = lookup_config(config_tree, "BroadcastSubnet"); cfg; cfg = lookup_config_next(config_tree, cfg)) { + subnet_t *s; + + if(!get_config_subnet(cfg, &s)) { + continue; + } + + subnet_add(NULL, s); + } + +#if !defined(IP_TOS) + + if(priorityinheritance) { + logger(DEBUG_ALWAYS, LOG_WARNING, "%s not supported on this platform for IPv4 connections", "PriorityInheritance"); + } + +#endif + +#if !defined(IPV6_TCLASS) + + if(priorityinheritance) { + logger(DEBUG_ALWAYS, LOG_WARNING, "%s not supported on this platform for IPv6 connections", "PriorityInheritance"); + } + +#endif + + if(!get_config_int(lookup_config(config_tree, "MACExpire"), &macexpire)) { + macexpire = 600; + } + + if(get_config_int(lookup_config(config_tree, "MaxTimeout"), &maxtimeout)) { + if(maxtimeout <= 0) { + logger(DEBUG_ALWAYS, LOG_ERR, "Bogus maximum timeout!"); + return false; + } + } else { + maxtimeout = 900; + } + + if(get_config_string(lookup_config(config_tree, "AddressFamily"), &afname)) { + if(!strcasecmp(afname, "IPv4")) { + addressfamily = AF_INET; + } else if(!strcasecmp(afname, "IPv6")) { + addressfamily = AF_INET6; + } else if(!strcasecmp(afname, "any")) { + addressfamily = AF_UNSPEC; + } else { + logger(DEBUG_ALWAYS, LOG_ERR, "Invalid address family!"); + return false; + } + + free(afname); + } + + get_config_bool(lookup_config(config_tree, "Hostnames"), &hostnames); + + if(!get_config_int(lookup_config(config_tree, "KeyExpire"), &keylifetime)) { + keylifetime = 3600; + } + + config_t *cfg = lookup_config(config_tree, "AutoConnect"); + + if(cfg) { + if(!get_config_bool(cfg, &autoconnect)) { + // Some backwards compatibility with when this option was an int + int val = 0; + get_config_int(cfg, &val); + autoconnect = val; + } + } + + get_config_bool(lookup_config(config_tree, "DisableBuggyPeers"), &disablebuggypeers); + + if(!get_config_int(lookup_config(config_tree, "InvitationExpire"), &invitation_lifetime)) { + invitation_lifetime = 604800; // 1 week + } + + read_invitation_key(); + + return true; +} + +/* + Add listening sockets. +*/ +static bool add_listen_address(char *address, bool bindto) { + char *port = myport; + + if(address) { + char *space = strchr(address, ' '); + + if(space) { + *space++ = 0; + port = space; + } + + if(!strcmp(address, "*")) { + *address = 0; + } + } + + struct addrinfo *ai, hint = {0}; + + hint.ai_family = addressfamily; + + hint.ai_socktype = SOCK_STREAM; - fp = fopen(fname, "r"); + hint.ai_protocol = IPPROTO_TCP; - if(!fp) { - logger(LOG_ERR, "Error reading RSA private key file `%s': %s", - fname, strerror(errno)); - free(fname); - return false; - } + hint.ai_flags = AI_PASSIVE; -#if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN) - if(fstat(fileno(fp), &s)) { - logger(LOG_ERR, "Could not stat RSA private key file `%s': %s'", - fname, strerror(errno)); - free(fname); - return false; - } +#if HAVE_DECL_RES_INIT + res_init(); - if(s.st_mode & ~0100700) - logger(LOG_WARNING, "Warning: insecure file permissions for RSA private key file `%s'!", fname); #endif + int err = getaddrinfo(address && *address ? address : NULL, port, &hint, &ai); - myself->connection->rsa_key = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL); - fclose(fp); + free(address); - if(!myself->connection->rsa_key) { - logger(LOG_ERR, "Reading RSA private key file `%s' failed: %s", - fname, strerror(errno)); - free(fname); + if(err || !ai) { + logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "getaddrinfo", err == EAI_SYSTEM ? strerror(err) : gai_strerror(err)); return false; } - free(fname); - return true; -} - -/* - Read Subnets from all host config files -*/ -void load_all_subnets(void) { - DIR *dir; - struct dirent *ent; - char *dname; - char *fname; - avl_tree_t *config_tree; - config_t *cfg; - subnet_t *s, *s2; - node_t *n; - bool result; + for(struct addrinfo *aip = ai; aip; aip = aip->ai_next) { + // Ignore duplicate addresses + bool found = false; - xasprintf(&dname, "%s/hosts", confbase); - dir = opendir(dname); - if(!dir) { - logger(LOG_ERR, "Could not open %s: %s", dname, strerror(errno)); - free(dname); - return; - } + for(int i = 0; i < listen_sockets; i++) + if(!memcmp(&listen_socket[i].sa, aip->ai_addr, aip->ai_addrlen)) { + found = true; + break; + } - while((ent = readdir(dir))) { - if(!check_id(ent->d_name)) + if(found) { continue; + } - n = lookup_node(ent->d_name); - if(n) - continue; + if(listen_sockets >= MAXSOCKETS) { + logger(DEBUG_ALWAYS, LOG_ERR, "Too many listening sockets"); + return false; + } - #ifdef _DIRENT_HAVE_D_TYPE - //if(ent->d_type != DT_REG) - // continue; - #endif + int tcp_fd = setup_listen_socket((sockaddr_t *) aip->ai_addr); - xasprintf(&fname, "%s/hosts/%s", confbase, ent->d_name); - init_configuration(&config_tree); - result = read_config_file(config_tree, fname); - free(fname); - if(!result) + if(tcp_fd < 0) { continue; + } + + int udp_fd = setup_vpn_in_socket((sockaddr_t *) aip->ai_addr); - n = new_node(); - n->name = xstrdup(ent->d_name); - node_add(n); + if(udp_fd < 0) { + close(tcp_fd); + continue; + } - for(cfg = lookup_config(config_tree, "Subnet"); cfg; cfg = lookup_config_next(config_tree, cfg)) { - if(!get_config_subnet(cfg, &s)) - continue; + io_add(&listen_socket[listen_sockets].tcp, handle_new_meta_connection, &listen_socket[listen_sockets], tcp_fd, IO_READ); + io_add(&listen_socket[listen_sockets].udp, handle_incoming_vpn_data, &listen_socket[listen_sockets], udp_fd, IO_READ); - if((s2 = lookup_subnet(n, s))) { - s2->expires = -1; - } else { - subnet_add(n, s); - } + if(debug_level >= DEBUG_CONNECTIONS) { + char *hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr); + logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Listening on %s", hostname); + free(hostname); } - exit_configuration(&config_tree); + listen_socket[listen_sockets].bindto = bindto; + memcpy(&listen_socket[listen_sockets].sa, aip->ai_addr, aip->ai_addrlen); + listen_sockets++; } - closedir(dir); + freeaddrinfo(ai); + return true; +} + +void device_enable(void) { + if(devops.enable) { + devops.enable(); + } + + /* Run tinc-up script to further initialize the tap interface */ + + environment_t env; + environment_init(&env); + execute_script("tinc-up", &env); + environment_exit(&env); +} + +void device_disable(void) { + environment_t env; + environment_init(&env); + execute_script("tinc-down", &env); + environment_exit(&env); + + if(devops.disable) { + devops.disable(); + } } /* Configure node_t myself and set up the local sockets (listen only) */ -bool setup_myself(void) { - config_t *cfg; - subnet_t *subnet; - char *name, *hostname, *mode, *afname, *cipher, *digest; +static bool setup_myself(void) { + char *name, *hostname, *cipher, *digest, *type; char *address = NULL; - char *envp[5]; - struct addrinfo *ai, *aip, hint = {0}; - bool choice; - int i, err; + bool port_specified = false; + + if(!(name = get_name())) { + logger(DEBUG_ALWAYS, LOG_ERR, "Name for tinc daemon required!"); + return false; + } + myname = xstrdup(name); myself = new_node(); myself->connection = new_connection(); - init_configuration(&myself->connection->config_tree); + myself->name = name; + myself->connection->name = xstrdup(name); + read_host_config(config_tree, name, true); - myself->hostname = xstrdup("MYSELF"); - myself->connection->hostname = xstrdup("MYSELF"); + if(!get_config_string(lookup_config(config_tree, "Port"), &myport)) { + myport = xstrdup("655"); + } else { + port_specified = true; + } myself->connection->options = 0; - myself->connection->protocol_version = PROT_CURRENT; + myself->connection->protocol_major = PROT_MAJOR; + myself->connection->protocol_minor = PROT_MINOR; - if(!get_config_string(lookup_config(config_tree, "Name"), &name)) { /* Not acceptable */ - logger(LOG_ERR, "Name for tinc daemon required!"); - return false; - } + myself->options |= PROT_MINOR << 24; - if(!check_id(name)) { - logger(LOG_ERR, "Invalid name for myself!"); - free(name); +#ifdef DISABLE_LEGACY + experimental = read_ecdsa_private_key(); + + if(!experimental) { + logger(DEBUG_ALWAYS, LOG_ERR, "No private key available, cannot start tinc!"); return false; } - myself->name = name; - myself->connection->name = xstrdup(name); +#else - if(!read_connection_config(myself->connection)) { - logger(LOG_ERR, "Cannot open host configuration file for myself!"); - return false; + if(!get_config_bool(lookup_config(config_tree, "ExperimentalProtocol"), &experimental)) { + experimental = read_ecdsa_private_key(); + + if(!experimental) { + logger(DEBUG_ALWAYS, LOG_WARNING, "Support for SPTPS disabled."); + } + } else { + if(experimental && !read_ecdsa_private_key()) { + return false; + } } - if(!read_rsa_private_key()) - return false; + if(!read_rsa_private_key()) { + if(experimental) { + logger(DEBUG_ALWAYS, LOG_WARNING, "Support for legacy protocol disabled."); + } else { + logger(DEBUG_ALWAYS, LOG_ERR, "No private keys available, cannot start tinc!"); + return false; + } + } - if(!get_config_string(lookup_config(config_tree, "Port"), &myport) - && !get_config_string(lookup_config(myself->connection->config_tree, "Port"), &myport)) - myport = xstrdup("655"); +#endif + + /* Ensure myport is numeric */ if(!atoi(myport)) { struct addrinfo *ai = str2addrinfo("localhost", myport, SOCK_DGRAM); sockaddr_t sa; - if(!ai || !ai->ai_addr) + + if(!ai || !ai->ai_addr) { return false; + } + free(myport); memcpy(&sa, ai->ai_addr, ai->ai_addrlen); + freeaddrinfo(ai); sockaddr2str(&sa, NULL, &myport); } /* Read in all the subnets specified in the host configuration file */ - cfg = lookup_config(myself->connection->config_tree, "Subnet"); + for(config_t *cfg = lookup_config(config_tree, "Subnet"); cfg; cfg = lookup_config_next(config_tree, cfg)) { + subnet_t *subnet; - while(cfg) { - if(!get_config_subnet(cfg, &subnet)) + if(!get_config_subnet(cfg, &subnet)) { return false; + } subnet_add(myself, subnet); - - cfg = lookup_config_next(myself->connection->config_tree, cfg); } /* Check some options */ - if(get_config_bool(lookup_config(config_tree, "IndirectData"), &choice) && choice) - myself->options |= OPTION_INDIRECT; - - if(get_config_bool(lookup_config(config_tree, "TCPOnly"), &choice) && choice) - myself->options |= OPTION_TCPONLY; - - if(get_config_bool(lookup_config(myself->connection->config_tree, "IndirectData"), &choice) && choice) - myself->options |= OPTION_INDIRECT; - - if(get_config_bool(lookup_config(myself->connection->config_tree, "TCPOnly"), &choice) && choice) - myself->options |= OPTION_TCPONLY; - - if(myself->options & OPTION_TCPONLY) - myself->options |= OPTION_INDIRECT; + if(!setup_myself_reloadable()) { + return false; + } - get_config_bool(lookup_config(config_tree, "DirectOnly"), &directonly); get_config_bool(lookup_config(config_tree, "StrictSubnets"), &strictsubnets); get_config_bool(lookup_config(config_tree, "TunnelServer"), &tunnelserver); strictsubnets |= tunnelserver; - if(get_config_string(lookup_config(config_tree, "Mode"), &mode)) { - if(!strcasecmp(mode, "router")) - routing_mode = RMODE_ROUTER; - else if(!strcasecmp(mode, "switch")) - routing_mode = RMODE_SWITCH; - else if(!strcasecmp(mode, "hub")) - routing_mode = RMODE_HUB; - else { - logger(LOG_ERR, "Invalid routing mode!"); + if(get_config_int(lookup_config(config_tree, "MaxConnectionBurst"), &max_connection_burst)) { + if(max_connection_burst <= 0) { + logger(DEBUG_ALWAYS, LOG_ERR, "MaxConnectionBurst cannot be negative!"); return false; } - free(mode); } - if(get_config_string(lookup_config(config_tree, "Forwarding"), &mode)) { - if(!strcasecmp(mode, "off")) - forwarding_mode = FMODE_OFF; - else if(!strcasecmp(mode, "internal")) - forwarding_mode = FMODE_INTERNAL; - else if(!strcasecmp(mode, "kernel")) - forwarding_mode = FMODE_KERNEL; - else { - logger(LOG_ERR, "Invalid forwarding mode!"); + if(get_config_int(lookup_config(config_tree, "UDPRcvBuf"), &udp_rcvbuf)) { + if(udp_rcvbuf < 0) { + logger(DEBUG_ALWAYS, LOG_ERR, "UDPRcvBuf cannot be negative!"); return false; } - free(mode); } - choice = true; - get_config_bool(lookup_config(myself->connection->config_tree, "PMTUDiscovery"), &choice); - get_config_bool(lookup_config(config_tree, "PMTUDiscovery"), &choice); - if(choice) - myself->options |= OPTION_PMTU_DISCOVERY; - - choice = true; - get_config_bool(lookup_config(config_tree, "ClampMSS"), &choice); - get_config_bool(lookup_config(myself->connection->config_tree, "ClampMSS"), &choice); - if(choice) - myself->options |= OPTION_CLAMP_MSS; - - get_config_bool(lookup_config(config_tree, "PriorityInheritance"), &priorityinheritance); - -#if !defined(SOL_IP) || !defined(IP_TOS) - if(priorityinheritance) - logger(LOG_WARNING, "%s not supported on this platform", "PriorityInheritance"); -#endif - - if(!get_config_int(lookup_config(config_tree, "MACExpire"), &macexpire)) - macexpire = 600; - - if(get_config_int(lookup_config(config_tree, "MaxTimeout"), &maxtimeout)) { - if(maxtimeout <= 0) { - logger(LOG_ERR, "Bogus maximum timeout!"); + if(get_config_int(lookup_config(config_tree, "UDPSndBuf"), &udp_sndbuf)) { + if(udp_sndbuf < 0) { + logger(DEBUG_ALWAYS, LOG_ERR, "UDPSndBuf cannot be negative!"); return false; } - } else - maxtimeout = 900; + } - if(get_config_string(lookup_config(config_tree, "AddressFamily"), &afname)) { - if(!strcasecmp(afname, "IPv4")) - addressfamily = AF_INET; - else if(!strcasecmp(afname, "IPv6")) - addressfamily = AF_INET6; - else if(!strcasecmp(afname, "any")) - addressfamily = AF_UNSPEC; - else { - logger(LOG_ERR, "Invalid address family!"); + int replaywin_int; + + if(get_config_int(lookup_config(config_tree, "ReplayWindow"), &replaywin_int)) { + if(replaywin_int < 0) { + logger(DEBUG_ALWAYS, LOG_ERR, "ReplayWindow cannot be negative!"); return false; } - free(afname); - } - get_config_bool(lookup_config(config_tree, "Hostnames"), &hostnames); + replaywin = (unsigned)replaywin_int; + sptps_replaywin = replaywin; + } +#ifndef DISABLE_LEGACY /* Generate packet encryption key */ - if(get_config_string - (lookup_config(myself->connection->config_tree, "Cipher"), &cipher)) { - if(!strcasecmp(cipher, "none")) { - myself->incipher = NULL; - } else { - myself->incipher = EVP_get_cipherbyname(cipher); - - if(!myself->incipher) { - logger(LOG_ERR, "Unrecognized cipher type!"); - return false; - } - } - } else - myself->incipher = EVP_bf_cbc(); + if(!get_config_string(lookup_config(config_tree, "Cipher"), &cipher)) { + cipher = xstrdup("aes-256-cbc"); + } - if(myself->incipher) - myself->inkeylength = myself->incipher->key_len + myself->incipher->iv_len; - else - myself->inkeylength = 1; + if(!strcasecmp(cipher, "none")) { + myself->incipher = NULL; + } else if(!(myself->incipher = cipher_open_by_name(cipher))) { + logger(DEBUG_ALWAYS, LOG_ERR, "Unrecognized cipher type!"); + return false; + } - myself->connection->outcipher = EVP_bf_ofb(); + free(cipher); - if(!get_config_int(lookup_config(config_tree, "KeyExpire"), &keylifetime)) - keylifetime = 3600; + timeout_add(&keyexpire_timeout, keyexpire_handler, &keyexpire_timeout, &(struct timeval) { + keylifetime, rand() % 100000 + }); - keyexpires = now + keylifetime; - /* Check if we want to use message authentication codes... */ - if(get_config_string(lookup_config(myself->connection->config_tree, "Digest"), &digest)) { - if(!strcasecmp(digest, "none")) { - myself->indigest = NULL; - } else { - myself->indigest = EVP_get_digestbyname(digest); + int maclength = 4; + get_config_int(lookup_config(config_tree, "MACLength"), &maclength); - if(!myself->indigest) { - logger(LOG_ERR, "Unrecognized digest type!"); - return false; - } - } - } else - myself->indigest = EVP_sha1(); + if(maclength < 0) { + logger(DEBUG_ALWAYS, LOG_ERR, "Bogus MAC length!"); + return false; + } - myself->connection->outdigest = EVP_sha1(); + if(!get_config_string(lookup_config(config_tree, "Digest"), &digest)) { + digest = xstrdup("sha256"); + } - if(get_config_int(lookup_config(myself->connection->config_tree, "MACLength"), &myself->inmaclength)) { - if(myself->indigest) { - if(myself->inmaclength > myself->indigest->md_size) { - logger(LOG_ERR, "MAC length exceeds size of digest!"); - return false; - } else if(myself->inmaclength < 0) { - logger(LOG_ERR, "Bogus MAC length!"); - return false; - } - } - } else - myself->inmaclength = 4; + if(!strcasecmp(digest, "none")) { + myself->indigest = NULL; + } else if(!(myself->indigest = digest_open_by_name(digest, maclength))) { + logger(DEBUG_ALWAYS, LOG_ERR, "Unrecognized digest type!"); + return false; + } - myself->connection->outmaclength = 0; + free(digest); +#endif /* Compression */ - if(get_config_int(lookup_config(myself->connection->config_tree, "Compression"), &myself->incompression)) { + if(get_config_int(lookup_config(config_tree, "Compression"), &myself->incompression)) { if(myself->incompression < 0 || myself->incompression > 11) { - logger(LOG_ERR, "Bogus compression level!"); + logger(DEBUG_ALWAYS, LOG_ERR, "Bogus compression level!"); return false; } - } else + } else { myself->incompression = 0; + } myself->connection->outcompression = 0; @@ -511,85 +1023,178 @@ bool setup_myself(void) { myself->nexthop = myself; myself->via = myself; myself->status.reachable = true; + myself->last_state_change = now.tv_sec; + myself->status.sptps = experimental; node_add(myself); graph(); - if(strictsubnets) - load_all_subnets(); + load_all_nodes(); /* Open device */ - if(!setup_device()) - return false; + devops = os_devops; + + if(get_config_string(lookup_config(config_tree, "DeviceType"), &type)) { + if(!strcasecmp(type, "dummy")) { + devops = dummy_devops; + } else if(!strcasecmp(type, "raw_socket")) { + devops = raw_socket_devops; + } else if(!strcasecmp(type, "multicast")) { + devops = multicast_devops; + } else if(!strcasecmp(type, "fd")) { + devops = fd_devops; + } - /* Run tinc-up script to further initialize the tap interface */ - xasprintf(&envp[0], "NETNAME=%s", netname ? : ""); - xasprintf(&envp[1], "DEVICE=%s", device ? : ""); - xasprintf(&envp[2], "INTERFACE=%s", iface ? : ""); - xasprintf(&envp[3], "NAME=%s", myself->name); - envp[4] = NULL; +#ifdef ENABLE_UML + else if(!strcasecmp(type, "uml")) { + devops = uml_devops; + } - execute_script("tinc-up", envp); +#endif +#ifdef ENABLE_VDE + else if(!strcasecmp(type, "vde")) { + devops = vde_devops; + } + +#endif + free(type); + } - for(i = 0; i < 5; i++) - free(envp[i]); + get_config_bool(lookup_config(config_tree, "DeviceStandby"), &device_standby); - /* Run subnet-up scripts for our own subnets */ + if(!devops.setup()) { + return false; + } - subnet_update(myself, NULL, true); + if(device_fd >= 0) { + io_add(&device_io, handle_device_data, NULL, device_fd, IO_READ); + } /* Open sockets */ - get_config_string(lookup_config(config_tree, "BindToAddress"), &address); + if(!do_detach && getenv("LISTEN_FDS")) { + sockaddr_t sa; + socklen_t salen; - hint.ai_family = addressfamily; - hint.ai_socktype = SOCK_STREAM; - hint.ai_protocol = IPPROTO_TCP; - hint.ai_flags = AI_PASSIVE; + listen_sockets = atoi(getenv("LISTEN_FDS")); +#ifdef HAVE_UNSETENV + unsetenv("LISTEN_FDS"); +#endif - err = getaddrinfo(address, myport, &hint, &ai); + if(listen_sockets > MAXSOCKETS) { + logger(DEBUG_ALWAYS, LOG_ERR, "Too many listening sockets"); + return false; + } - if(err || !ai) { - logger(LOG_ERR, "System call `%s' failed: %s", "getaddrinfo", - gai_strerror(err)); + for(int i = 0; i < listen_sockets; i++) { + salen = sizeof(sa); + + if(getsockname(i + 3, &sa.sa, &salen) < 0) { + logger(DEBUG_ALWAYS, LOG_ERR, "Could not get address of listen fd %d: %s", i + 3, sockstrerror(sockerrno)); + return false; + } + +#ifdef FD_CLOEXEC + fcntl(i + 3, F_SETFD, FD_CLOEXEC); +#endif + + int udp_fd = setup_vpn_in_socket(&sa); + + if(udp_fd < 0) { + return false; + } + + io_add(&listen_socket[i].tcp, (io_cb_t)handle_new_meta_connection, &listen_socket[i], i + 3, IO_READ); + io_add(&listen_socket[i].udp, (io_cb_t)handle_incoming_vpn_data, &listen_socket[i], udp_fd, IO_READ); + + if(debug_level >= DEBUG_CONNECTIONS) { + hostname = sockaddr2hostname(&sa); + logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Listening on %s", hostname); + free(hostname); + } + + memcpy(&listen_socket[i].sa, &sa, salen); + } + } else { + listen_sockets = 0; + int cfgs = 0; + + for(config_t *cfg = lookup_config(config_tree, "BindToAddress"); cfg; cfg = lookup_config_next(config_tree, cfg)) { + cfgs++; + get_config_string(cfg, &address); + + if(!add_listen_address(address, true)) { + return false; + } + } + + for(config_t *cfg = lookup_config(config_tree, "ListenAddress"); cfg; cfg = lookup_config_next(config_tree, cfg)) { + cfgs++; + get_config_string(cfg, &address); + + if(!add_listen_address(address, false)) { + return false; + } + } + + if(!cfgs) + if(!add_listen_address(address, NULL)) { + return false; + } + } + + if(!listen_sockets) { + logger(DEBUG_ALWAYS, LOG_ERR, "Unable to create any listening socket!"); return false; } - listen_sockets = 0; + /* If no Port option was specified, set myport to the port used by the first listening socket. */ - for(aip = ai; aip; aip = aip->ai_next) { - listen_socket[listen_sockets].tcp = - setup_listen_socket((sockaddr_t *) aip->ai_addr); + if(!port_specified || atoi(myport) == 0) { + sockaddr_t sa; + socklen_t salen = sizeof(sa); - if(listen_socket[listen_sockets].tcp < 0) - continue; + if(!getsockname(listen_socket[0].udp.fd, &sa.sa, &salen)) { + free(myport); + sockaddr2str(&sa, NULL, &myport); + + if(!myport) { + myport = xstrdup("655"); + } + } + } - listen_socket[listen_sockets].udp = - setup_vpn_in_socket((sockaddr_t *) aip->ai_addr); + xasprintf(&myself->hostname, "MYSELF port %s", myport); + myself->connection->hostname = xstrdup(myself->hostname); - if(listen_socket[listen_sockets].udp < 0) - continue; + char *upnp = NULL; + get_config_string(lookup_config(config_tree, "UPnP"), &upnp); + bool upnp_tcp = false; + bool upnp_udp = false; - ifdebug(CONNECTIONS) { - hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr); - logger(LOG_NOTICE, "Listening on %s", hostname); - free(hostname); + if(upnp) { + if(!strcasecmp(upnp, "yes")) { + upnp_tcp = upnp_udp = true; + } else if(!strcasecmp(upnp, "udponly")) { + upnp_udp = true; } - memcpy(&listen_socket[listen_sockets].sa, aip->ai_addr, aip->ai_addrlen); - listen_sockets++; + free(upnp); } - freeaddrinfo(ai); - - if(listen_sockets) - logger(LOG_NOTICE, "Ready"); - else { - logger(LOG_ERR, "Unable to create any listening socket!"); - return false; + if(upnp_tcp || upnp_udp) { +#ifdef HAVE_MINIUPNPC + upnp_init(upnp_tcp, upnp_udp); +#else + logger(DEBUG_ALWAYS, LOG_WARNING, "UPnP was requested, but tinc isn't built with miniupnpc support!"); +#endif } + /* Done. */ + + last_config_check = now.tv_sec; + return true; } @@ -597,9 +1202,6 @@ bool setup_myself(void) { initialize network */ bool setup_network(void) { - now = time(NULL); - - init_events(); init_connections(); init_subnets(); init_nodes(); @@ -610,19 +1212,37 @@ bool setup_network(void) { if(pinginterval < 1) { pinginterval = 86400; } - } else + } else { pinginterval = 60; + } - if(!get_config_int(lookup_config(config_tree, "PingTimeout"), &pingtimeout)) + if(!get_config_int(lookup_config(config_tree, "PingTimeout"), &pingtimeout)) { pingtimeout = 5; - if(pingtimeout < 1 || pingtimeout > pinginterval) + } + + if(pingtimeout < 1 || pingtimeout > pinginterval) { pingtimeout = pinginterval; + } - if(!get_config_int(lookup_config(config_tree, "MaxOutputBufferSize"), &maxoutbufsize)) + if(!get_config_int(lookup_config(config_tree, "MaxOutputBufferSize"), &maxoutbufsize)) { maxoutbufsize = 10 * MTU; + } + + if(!setup_myself()) { + return false; + } - if(!setup_myself()) + if(!init_control()) { return false; + } + + if(!device_standby) { + device_enable(); + } + + /* Run subnet-up scripts for our own subnets */ + + subnet_update(myself, NULL, true); return true; } @@ -631,59 +1251,59 @@ bool setup_network(void) { close all open network connections */ void close_network_connections(void) { - avl_node_t *node, *next; - connection_t *c; - char *envp[5]; - int i; - - for(node = connection_tree->head; node; node = next) { + for(list_node_t *node = connection_list->head, *next; node; node = next) { next = node->next; - c = node->data; + connection_t *c = node->data; + + /* Keep control connections open until the end, so they know when we really terminated */ + if(c->status.control) { + c->socket = -1; + } + c->outgoing = NULL; terminate_connection(c, false); } - for(list_node_t *node = outgoing_list->head; node; node = node->next) { - outgoing_t *outgoing = node->data; - - if(outgoing->event) - event_del(outgoing->event); + if(outgoing_list) { + list_delete_list(outgoing_list); } - list_delete_list(outgoing_list); - if(myself && myself->connection) { subnet_update(myself, NULL, false); - terminate_connection(myself->connection, false); - free_connection(myself->connection); + connection_del(myself->connection); } - for(i = 0; i < listen_sockets; i++) { - close(listen_socket[i].tcp); - close(listen_socket[i].udp); + for(int i = 0; i < listen_sockets; i++) { + io_del(&listen_socket[i].tcp); + io_del(&listen_socket[i].udp); + close(listen_socket[i].tcp.fd); + close(listen_socket[i].udp.fd); } - xasprintf(&envp[0], "NETNAME=%s", netname ? : ""); - xasprintf(&envp[1], "DEVICE=%s", device ? : ""); - xasprintf(&envp[2], "INTERFACE=%s", iface ? : ""); - xasprintf(&envp[3], "NAME=%s", myself->name); - envp[4] = NULL; - exit_requests(); exit_edges(); exit_subnets(); exit_nodes(); exit_connections(); - exit_events(); - execute_script("tinc-down", envp); + if(!device_standby) { + device_disable(); + } + + free(myport); + + if(device_fd >= 0) { + io_del(&device_io); + } - if(myport) free(myport); + if(devops.close) { + devops.close(); + } - for(i = 0; i < 4; i++) - free(envp[i]); + exit_control(); - close_device(); + free(scriptextension); + free(scriptinterpreter); return; }