X-Git-Url: https://www.tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Ftincctl.c;h=00a296dc73a1184fd8b915ecefae01253b075d42;hb=80b81c00b129b006981b76bdb734df3296317d6f;hp=4357d4a0e2209cdddadc28d13f0765d237ae65e1;hpb=33f241d97852d7a171f1aaf1bda7f66356ff889e;p=tinc diff --git a/src/tincctl.c b/src/tincctl.c index 4357d4a0..00a296dc 100644 --- a/src/tincctl.c +++ b/src/tincctl.c @@ -24,6 +24,7 @@ #include "xalloc.h" #include "protocol.h" #include "control_common.h" +#include "ecdsagen.h" #include "rsagen.h" #include "utils.h" #include "tincctl.h" @@ -40,11 +41,10 @@ static bool show_version = false; static char *name = NULL; static char *identname = NULL; /* program name for syslog */ -static char *controlcookiename = NULL; /* cookie file location */ +static char *pidfilename = NULL; /* pid file location */ static char controlcookie[1024]; char *netname = NULL; char *confbase = NULL; -static char *host = NULL; #ifdef HAVE_MINGW static struct WSAData wsa_state; @@ -52,11 +52,10 @@ static struct WSAData wsa_state; static struct option const long_options[] = { {"config", required_argument, NULL, 'c'}, - {"host", required_argument, NULL, 'h'}, {"net", required_argument, NULL, 'n'}, {"help", no_argument, NULL, 1}, {"version", no_argument, NULL, 2}, - {"controlcookie", required_argument, NULL, 5}, + {"pidfile", required_argument, NULL, 5}, {NULL, 0, NULL, 0} }; @@ -67,11 +66,11 @@ static void usage(bool status) { else { printf("Usage: %s [options] command\n\n", program_name); printf("Valid options are:\n" - " -c, --config=DIR Read configuration options from DIR.\n" - " -n, --net=NETNAME Connect to net NETNAME.\n" - " --controlcookie=FILENAME Read control socket from FILENAME.\n" - " --help Display this help and exit.\n" - " --version Output version information and exit.\n" + " -c, --config=DIR Read configuration options from DIR.\n" + " -n, --net=NETNAME Connect to net NETNAME.\n" + " --pidfile=FILENAME Read control cookie from FILENAME.\n" + " --help Display this help and exit.\n" + " --version Output version information and exit.\n" "\n" "Valid commands are:\n" " start Start tincd.\n" @@ -79,7 +78,9 @@ static void usage(bool status) { " restart Restart tincd.\n" " reload Reload configuration of running tincd.\n" " pid Show PID of currently running tincd.\n" - " generate-keys [bits] Generate a new public/private keypair.\n" + " generate-keys [bits] Generate new RSA and ECDSA public/private keypairs.\n" + " generate-rsa-keys [bits] Generate a new RSA public/private keypair.\n" + " generate-ecdsa-keys Generate a new ECDSA public/private keypair.\n" " dump Dump a list of one of the following things:\n" " nodes - all known nodes in the VPN\n" " edges - all known connections in the VPN\n" @@ -104,7 +105,7 @@ static bool parse_options(int argc, char **argv) { int r; int option_index = 0; - while((r = getopt_long(argc, argv, "c:n:h:", long_options, &option_index)) != EOF) { + while((r = getopt_long(argc, argv, "c:n:", long_options, &option_index)) != EOF) { switch (r) { case 0: /* long option */ break; @@ -113,10 +114,6 @@ static bool parse_options(int argc, char **argv) { confbase = xstrdup(optarg); break; - case 'h': /* alternative host to connect to */ - host = xstrdup(optarg); - break; - case 'n': /* net name given */ netname = xstrdup(optarg); break; @@ -130,7 +127,7 @@ static bool parse_options(int argc, char **argv) { break; case 5: /* open control socket here */ - controlcookiename = xstrdup(optarg); + pidfilename = xstrdup(optarg); break; case '?': @@ -197,11 +194,70 @@ FILE *ask_and_open(const char *filename, const char *what, const char *mode) { return r; } +/* + Generate a public/private ECDSA keypair, and ask for a file to store + them in. +*/ +static bool ecdsa_keygen() { + ecdsa_t key; + FILE *f; + char *filename; + + fprintf(stderr, "Generating ECDSA keypair:\n"); + + if(!ecdsa_generate(&key)) { + fprintf(stderr, "Error during key generation!\n"); + return false; + } else + fprintf(stderr, "Done.\n"); + + xasprintf(&filename, "%s/ecdsa_key.priv", confbase); + f = ask_and_open(filename, "private ECDSA key", "a"); + + if(!f) + return false; + +#ifdef HAVE_FCHMOD + /* Make it unreadable for others. */ + fchmod(fileno(f), 0600); +#endif + + if(ftell(f)) + fprintf(stderr, "Appending key to existing contents.\nMake sure only one key is stored in the file.\n"); + + ecdsa_write_pem_private_key(&key, f); + + fclose(f); + free(filename); + + if(name) + xasprintf(&filename, "%s/hosts/%s", confbase, name); + else + xasprintf(&filename, "%s/ecdsa_key.pub", confbase); + + f = ask_and_open(filename, "public ECDSA key", "a"); + + if(!f) + return false; + + if(ftell(f)) + fprintf(stderr, "Appending key to existing contents.\nMake sure only one key is stored in the file.\n"); + + char *pubkey = ecdsa_get_base64_public_key(&key); + fprintf(f, "ECDSAPublicKey = %s\n", pubkey); + free(pubkey); + + fclose(f); + free(filename); + + return true; +} + /* Generate a public/private RSA keypair, and ask for a file to store them in. */ -static bool keygen(int bits) { +static bool rsa_keygen(int bits) { rsa_t key; FILE *f; char *filename; @@ -279,16 +335,16 @@ static void make_names(void) { xasprintf(&confbase, "%s", installdir); } } - if(!controlcookiename) - xasprintf(&controlcookiename, "%s/cookie", confbase); + if(!pidfilename) + xasprintf(&pidfilename, "%s/pid", confbase); RegCloseKey(key); if(*installdir) return; } #endif - if(!controlcookiename) - xasprintf(&controlcookiename, "%s/run/%s.cookie", LOCALSTATEDIR, identname); + if(!pidfilename) + xasprintf(&pidfilename, "%s/run/%s.pid", LOCALSTATEDIR, identname); if(netname) { if(!confbase) @@ -429,6 +485,7 @@ void pcap(int fd, FILE *out) { int main(int argc, char *argv[], char *envp[]) { int fd; int result; + char host[128]; char port[128]; int pid; @@ -464,8 +521,16 @@ int main(int argc, char *argv[], char *envp[]) { // First handle commands that don't involve connecting to a running tinc daemon. + if(!strcasecmp(argv[optind], "generate-rsa-keys")) { + return !rsa_keygen(optind > argc ? atoi(argv[optind + 1]) : 2048); + } + + if(!strcasecmp(argv[optind], "generate-ecdsa-keys")) { + return !ecdsa_keygen(); + } + if(!strcasecmp(argv[optind], "generate-keys")) { - return !keygen(optind > argc ? atoi(argv[optind + 1]) : 2048); + return !(rsa_keygen(optind > argc ? atoi(argv[optind + 1]) : 2048) && ecdsa_keygen()); } if(!strcasecmp(argv[optind], "start")) { @@ -482,13 +547,13 @@ int main(int argc, char *argv[], char *envp[]) { * ancestors are writable only by trusted users, which we don't verify. */ - FILE *f = fopen(controlcookiename, "r"); + FILE *f = fopen(pidfilename, "r"); if(!f) { - fprintf(stderr, "Could not open control socket cookie file %s: %s\n", controlcookiename, strerror(errno)); + fprintf(stderr, "Could not open pid file %s: %s\n", pidfilename, strerror(errno)); return 1; } - if(fscanf(f, "%1024s %128s %20d", controlcookie, port, &pid) != 3) { - fprintf(stderr, "Could not parse control socket cookie file %s\n", controlcookiename); + if(fscanf(f, "%20d %1024s %128s port %128s", &pid, controlcookie, host, port) != 4) { + fprintf(stderr, "Could not parse pid file %s\n", pidfilename); return 1; }