Use threads for TCP connections.
[tinc] / src / net_setup.c
1 /*
2     net_setup.c -- Setup.
3     Copyright (C) 1998-2005 Ivo Timmermans,
4                   2000-2010 Guus Sliepen <guus@tinc-vpn.org>
5                   2006      Scott Lamb <slamb@slamb.org>
6                   2010      Brandon Black <blblack@gmail.com>
7
8     This program is free software; you can redistribute it and/or modify
9     it under the terms of the GNU General Public License as published by
10     the Free Software Foundation; either version 2 of the License, or
11     (at your option) any later version.
12
13     This program is distributed in the hope that it will be useful,
14     but WITHOUT ANY WARRANTY; without even the implied warranty of
15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16     GNU General Public License for more details.
17
18     You should have received a copy of the GNU General Public License along
19     with this program; if not, write to the Free Software Foundation, Inc.,
20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22
23 #include "system.h"
24
25 #include "splay_tree.h"
26 #include "cipher.h"
27 #include "conf.h"
28 #include "connection.h"
29 #include "control.h"
30 #include "device.h"
31 #include "digest.h"
32 #include "graph.h"
33 #include "logger.h"
34 #include "net.h"
35 #include "netutl.h"
36 #include "process.h"
37 #include "protocol.h"
38 #include "route.h"
39 #include "rsa.h"
40 #include "subnet.h"
41 #include "utils.h"
42 #include "xalloc.h"
43
44 char *myport;
45 static struct event device_ev;
46
47 bool read_rsa_public_key(connection_t *c) {
48         FILE *fp;
49         char *fname;
50         char *n;
51         bool result;
52
53         /* First, check for simple PublicKey statement */
54
55         if(get_config_string(lookup_config(c->config_tree, "PublicKey"), &n)) {
56                 result = rsa_set_hex_public_key(&c->rsa, n, "FFFF");
57                 free(n);
58                 return result;
59         }
60
61         /* Else, check for PublicKeyFile statement and read it */
62
63         if(!get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &fname))
64                 xasprintf(&fname, "%s/hosts/%s", confbase, c->name);
65
66         fp = fopen(fname, "r");
67
68         if(!fp) {
69                 logger(LOG_ERR, "Error reading RSA public key file `%s': %s",
70                            fname, strerror(errno));
71                 free(fname);
72                 return false;
73         }
74
75         result = rsa_read_pem_public_key(&c->rsa, fp);
76         fclose(fp);
77
78         if(!result) 
79                 logger(LOG_ERR, "Reading RSA public key file `%s' failed: %s", fname, strerror(errno));
80         free(fname);
81         return result;
82 }
83
84 bool read_rsa_private_key() {
85         FILE *fp;
86         char *fname;
87         char *n, *d;
88         bool result;
89
90         /* First, check for simple PrivateKey statement */
91
92         if(get_config_string(lookup_config(config_tree, "PrivateKey"), &d)) {
93                 if(!get_config_string(lookup_config(config_tree, "PublicKey"), &n)) {
94                         logger(LOG_ERR, "PrivateKey used but no PublicKey found!");
95                         free(d);
96                         return false;
97                 }
98                 result = rsa_set_hex_private_key(&myself->connection->rsa, n, "FFFF", d);
99                 free(n);
100                 free(d);
101                 return true;
102         }
103
104         /* Else, check for PrivateKeyFile statement and read it */
105
106         if(!get_config_string(lookup_config(config_tree, "PrivateKeyFile"), &fname))
107                 xasprintf(&fname, "%s/rsa_key.priv", confbase);
108
109         fp = fopen(fname, "r");
110
111         if(!fp) {
112                 logger(LOG_ERR, "Error reading RSA private key file `%s': %s",
113                            fname, strerror(errno));
114                 free(fname);
115                 return false;
116         }
117
118 #if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN)
119         struct stat s;
120
121         if(fstat(fileno(fp), &s)) {
122                 logger(LOG_ERR, "Could not stat RSA private key file `%s': %s'", fname, strerror(errno));
123                 free(fname);
124                 return false;
125         }
126
127         if(s.st_mode & ~0100700)
128                 logger(LOG_WARNING, "Warning: insecure file permissions for RSA private key file `%s'!", fname);
129 #endif
130
131         result = rsa_read_pem_private_key(&myself->connection->rsa, fp);
132         fclose(fp);
133
134         if(!result) 
135                 logger(LOG_ERR, "Reading RSA private key file `%s' failed: %s", fname, strerror(errno));
136         free(fname);
137         return result;
138 }
139
140 static struct event keyexpire_event;
141
142 static void keyexpire_handler(int fd, short events, void *data) {
143         regenerate_key();
144 }
145
146 void regenerate_key() {
147         if(timeout_initialized(&keyexpire_event)) {
148                 ifdebug(STATUS) logger(LOG_INFO, "Expiring symmetric keys");
149                 event_del(&keyexpire_event);
150                 send_key_changed(broadcast, myself);
151         } else {
152                 timeout_set(&keyexpire_event, keyexpire_handler, NULL);
153         }
154
155         event_add(&keyexpire_event, &(struct timeval){keylifetime, 0});
156 }
157
158 /*
159   Read Subnets from all host config files
160 */
161 void load_all_subnets(void) {
162         DIR *dir;
163         struct dirent *ent;
164         char *dname;
165         char *fname;
166         splay_tree_t *config_tree;
167         config_t *cfg;
168         subnet_t *s, *s2;
169         node_t *n;
170         bool result;
171
172         xasprintf(&dname, "%s/hosts", confbase);
173         dir = opendir(dname);
174         if(!dir) {
175                 logger(LOG_ERR, "Could not open %s: %s", dname, strerror(errno));
176                 free(dname);
177                 return;
178         }
179
180         while((ent = readdir(dir))) {
181                 if(!check_id(ent->d_name))
182                         continue;
183
184                 n = lookup_node(ent->d_name);
185                 #ifdef _DIRENT_HAVE_D_TYPE
186                 //if(ent->d_type != DT_REG)
187                 //      continue;
188                 #endif
189
190                 xasprintf(&fname, "%s/hosts/%s", confbase, ent->d_name);
191                 init_configuration(&config_tree);
192                 result = read_config_file(config_tree, fname);
193                 free(fname);
194                 if(!result)
195                         continue;
196
197                 if(!n) {
198                         n = new_node();
199                         n->name = xstrdup(ent->d_name);
200                         node_add(n);
201                 }
202
203                 for(cfg = lookup_config(config_tree, "Subnet"); cfg; cfg = lookup_config_next(config_tree, cfg)) {
204                         if(!get_config_subnet(cfg, &s))
205                                 continue;
206
207                         if((s2 = lookup_subnet(n, s))) {
208                                 s2->expires = -1;
209                         } else {
210                                 subnet_add(n, s);
211                         }
212                 }
213
214                 exit_configuration(&config_tree);
215         }
216
217         closedir(dir);
218 }
219
220 /*
221   Configure node_t myself and set up the local sockets (listen only)
222 */
223 bool setup_myself(void) {
224         config_t *cfg;
225         subnet_t *subnet;
226         char *name, *hostname, *mode, *afname, *cipher, *digest;
227         char *fname = NULL;
228         char *address = NULL;
229         char *envp[5];
230         struct addrinfo *ai, *aip, hint = {0};
231         bool choice;
232         int i, err;
233         int replaywin_int;
234
235         myself = new_node();
236         myself->connection = new_connection();
237
238         myself->hostname = xstrdup("MYSELF");
239         myself->connection->hostname = xstrdup("MYSELF");
240
241         myself->connection->options = 0;
242         myself->connection->protocol_version = PROT_CURRENT;
243
244         if(!get_config_string(lookup_config(config_tree, "Name"), &name)) {     /* Not acceptable */
245                 logger(LOG_ERR, "Name for tinc daemon required!");
246                 return false;
247         }
248
249         if(!check_id(name)) {
250                 logger(LOG_ERR, "Invalid name for myself!");
251                 free(name);
252                 return false;
253         }
254
255         myself->name = name;
256         myself->connection->name = xstrdup(name);
257         xasprintf(&fname, "%s/hosts/%s", confbase, name);
258         read_config_options(config_tree, name);
259         read_config_file(config_tree, fname);
260         free(fname);
261
262         if(!read_rsa_private_key())
263                 return false;
264
265         if(!get_config_string(lookup_config(config_tree, "Port"), &myport))
266                 myport = xstrdup("655");
267
268         if(!atoi(myport)) {
269                 struct addrinfo *ai = str2addrinfo("localhost", myport, SOCK_DGRAM);
270                 sockaddr_t sa;
271                 if(!ai || !ai->ai_addr)
272                         return false;
273                 free(myport);
274                 memcpy(&sa, ai->ai_addr, ai->ai_addrlen);
275                 sockaddr2str(&sa, NULL, &myport);
276         }
277
278         /* Read in all the subnets specified in the host configuration file */
279
280         cfg = lookup_config(config_tree, "Subnet");
281
282         while(cfg) {
283                 if(!get_config_subnet(cfg, &subnet))
284                         return false;
285
286                 subnet_add(myself, subnet);
287
288                 cfg = lookup_config_next(config_tree, cfg);
289         }
290
291         /* Check some options */
292
293         if(get_config_bool(lookup_config(config_tree, "IndirectData"), &choice) && choice)
294                 myself->options |= OPTION_INDIRECT;
295
296         if(get_config_bool(lookup_config(config_tree, "TCPOnly"), &choice) && choice)
297                 myself->options |= OPTION_TCPONLY;
298
299         if(myself->options & OPTION_TCPONLY)
300                 myself->options |= OPTION_INDIRECT;
301
302         get_config_bool(lookup_config(config_tree, "DirectOnly"), &directonly);
303         get_config_bool(lookup_config(config_tree, "StrictSubnets"), &strictsubnets);
304         get_config_bool(lookup_config(config_tree, "TunnelServer"), &tunnelserver);
305         strictsubnets |= tunnelserver;
306
307         if(get_config_string(lookup_config(config_tree, "Mode"), &mode)) {
308                 if(!strcasecmp(mode, "router"))
309                         routing_mode = RMODE_ROUTER;
310                 else if(!strcasecmp(mode, "switch"))
311                         routing_mode = RMODE_SWITCH;
312                 else if(!strcasecmp(mode, "hub"))
313                         routing_mode = RMODE_HUB;
314                 else {
315                         logger(LOG_ERR, "Invalid routing mode!");
316                         return false;
317                 }
318                 free(mode);
319         }
320
321         if(get_config_string(lookup_config(config_tree, "Forwarding"), &mode)) {
322                 if(!strcasecmp(mode, "off"))
323                         forwarding_mode = FMODE_OFF;
324                 else if(!strcasecmp(mode, "internal"))
325                         forwarding_mode = FMODE_INTERNAL;
326                 else if(!strcasecmp(mode, "kernel"))
327                         forwarding_mode = FMODE_KERNEL;
328                 else {
329                         logger(LOG_ERR, "Invalid forwarding mode!");
330                         return false;
331                 }
332                 free(mode);
333         }
334
335         choice = true;
336         get_config_bool(lookup_config(config_tree, "PMTUDiscovery"), &choice);
337         if(choice)
338                 myself->options |= OPTION_PMTU_DISCOVERY;
339
340         choice = true;
341         get_config_bool(lookup_config(config_tree, "ClampMSS"), &choice);
342         if(choice)
343                 myself->options |= OPTION_CLAMP_MSS;
344
345         get_config_bool(lookup_config(config_tree, "PriorityInheritance"), &priorityinheritance);
346
347 #if !defined(SOL_IP) || !defined(IP_TOS)
348         if(priorityinheritance)
349                 logger(LOG_WARNING, "%s not supported on this platform", "PriorityInheritance");
350 #endif
351
352         if(!get_config_int(lookup_config(config_tree, "MACExpire"), &macexpire))
353                 macexpire = 600;
354
355         if(get_config_int(lookup_config(config_tree, "MaxTimeout"), &maxtimeout)) {
356                 if(maxtimeout <= 0) {
357                         logger(LOG_ERR, "Bogus maximum timeout!");
358                         return false;
359                 }
360         } else
361                 maxtimeout = 900;
362
363         if(get_config_int(lookup_config(config_tree, "UDPRcvBuf"), &udp_rcvbuf)) {
364                 if(udp_rcvbuf <= 0) {
365                         logger(LOG_ERR, "UDPRcvBuf cannot be negative!");
366                         return false;
367                 }
368         }
369
370         if(get_config_int(lookup_config(config_tree, "UDPSndBuf"), &udp_sndbuf)) {
371                 if(udp_sndbuf <= 0) {
372                         logger(LOG_ERR, "UDPSndBuf cannot be negative!");
373                         return false;
374                 }
375         }
376
377         if(get_config_int(lookup_config(config_tree, "ReplayWindow"), &replaywin_int)) {
378                 if(replaywin_int < 0) {
379                         logger(LOG_ERR, "ReplayWindow cannot be negative!");
380                         return false;
381                 }
382                 replaywin = (unsigned)replaywin_int;
383         }
384
385         if(get_config_string(lookup_config(config_tree, "AddressFamily"), &afname)) {
386                 if(!strcasecmp(afname, "IPv4"))
387                         addressfamily = AF_INET;
388                 else if(!strcasecmp(afname, "IPv6"))
389                         addressfamily = AF_INET6;
390                 else if(!strcasecmp(afname, "any"))
391                         addressfamily = AF_UNSPEC;
392                 else {
393                         logger(LOG_ERR, "Invalid address family!");
394                         return false;
395                 }
396                 free(afname);
397         }
398
399         get_config_bool(lookup_config(config_tree, "Hostnames"), &hostnames);
400
401         /* Generate packet encryption key */
402
403         if(!get_config_string(lookup_config(config_tree, "Cipher"), &cipher))
404                 cipher = xstrdup("blowfish");
405
406         if(!cipher_open_by_name(&myself->incipher, cipher)) {
407                 logger(LOG_ERR, "Unrecognized cipher type!");
408                 return false;
409         }
410
411         if(!get_config_int(lookup_config(config_tree, "KeyExpire"), &keylifetime))
412                 keylifetime = 3600;
413
414         regenerate_key();
415
416         /* Check if we want to use message authentication codes... */
417
418         if(!get_config_string(lookup_config(config_tree, "Digest"), &digest))
419                 digest = xstrdup("sha1");
420
421         int maclength = 4;
422         get_config_int(lookup_config(config_tree, "MACLength"), &maclength);
423
424         if(maclength < 0) {
425                 logger(LOG_ERR, "Bogus MAC length!");
426                 return false;
427         }
428
429         if(!digest_open_by_name(&myself->indigest, digest, maclength)) {
430                 logger(LOG_ERR, "Unrecognized digest type!");
431                 return false;
432         }
433
434         /* Compression */
435
436         if(get_config_int(lookup_config(config_tree, "Compression"), &myself->incompression)) {
437                 if(myself->incompression < 0 || myself->incompression > 11) {
438                         logger(LOG_ERR, "Bogus compression level!");
439                         return false;
440                 }
441         } else
442                 myself->incompression = 0;
443
444         myself->connection->outcompression = 0;
445
446         /* Done */
447
448         myself->nexthop = myself;
449         myself->via = myself;
450         myself->status.reachable = true;
451         node_add(myself);
452
453         graph();
454
455         if(strictsubnets)
456                 load_all_subnets();
457
458         /* Open device */
459
460         if(!setup_device())
461                 return false;
462
463         if(device_fd >= 0) {
464                 event_set(&device_ev, device_fd, EV_READ|EV_PERSIST, handle_device_data, NULL);
465
466                 if (event_add(&device_ev, NULL) < 0) {
467                         logger(LOG_ERR, "event_add failed: %s", strerror(errno));
468                         close_device();
469                         return false;
470                 }
471         }
472
473         /* Run tinc-up script to further initialize the tap interface */
474         xasprintf(&envp[0], "NETNAME=%s", netname ? : "");
475         xasprintf(&envp[1], "DEVICE=%s", device ? : "");
476         xasprintf(&envp[2], "INTERFACE=%s", iface ? : "");
477         xasprintf(&envp[3], "NAME=%s", myself->name);
478         envp[4] = NULL;
479
480         execute_script("tinc-up", envp);
481
482         for(i = 0; i < 4; i++)
483                 free(envp[i]);
484
485         /* Run subnet-up scripts for our own subnets */
486
487         subnet_update(myself, NULL, true);
488
489         /* Open sockets */
490
491         get_config_string(lookup_config(config_tree, "BindToAddress"), &address);
492
493         hint.ai_family = addressfamily;
494         hint.ai_socktype = SOCK_STREAM;
495         hint.ai_protocol = IPPROTO_TCP;
496         hint.ai_flags = AI_PASSIVE;
497
498         err = getaddrinfo(address, myport, &hint, &ai);
499
500         if(err || !ai) {
501                 logger(LOG_ERR, "System call `%s' failed: %s", "getaddrinfo",
502                            gai_strerror(err));
503                 return false;
504         }
505
506         listen_sockets = 0;
507
508         for(aip = ai; aip; aip = aip->ai_next) {
509                 listen_socket[listen_sockets].tcp =
510                         setup_listen_socket((sockaddr_t *) aip->ai_addr);
511
512                 if(listen_socket[listen_sockets].tcp < 0)
513                         continue;
514
515                 listen_socket[listen_sockets].udp =
516                         setup_vpn_in_socket((sockaddr_t *) aip->ai_addr);
517
518                 if(listen_socket[listen_sockets].udp < 0) {
519                         close(listen_socket[listen_sockets].tcp);
520                         continue;
521                 }
522
523                 event_set(&listen_socket[listen_sockets].ev_tcp,
524                                   listen_socket[listen_sockets].tcp,
525                                   EV_READ|EV_PERSIST,
526                                   handle_new_meta_connection, NULL);
527                 if(event_add(&listen_socket[listen_sockets].ev_tcp, NULL) < 0) {
528                         logger(LOG_ERR, "event_add failed: %s", strerror(errno));
529                         abort();
530                 }
531
532                 if(!thread_create(&listen_socket[listen_sockets].udp_thread, handle_incoming_vpn_data, &listen_socket[listen_sockets])) {
533                         logger(LOG_ERR, "thread_create failed: %s", strerror(errno));
534                         abort();
535                 }
536
537                 ifdebug(CONNECTIONS) {
538                         hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr);
539                         logger(LOG_NOTICE, "Listening on %s", hostname);
540                         free(hostname);
541                 }
542
543                 memcpy(&listen_socket[listen_sockets].sa, aip->ai_addr, aip->ai_addrlen);
544                 listen_sockets++;
545
546                 if(listen_sockets >= MAXSOCKETS) {
547                         logger(LOG_WARNING, "Maximum of %d listening sockets reached", MAXSOCKETS);
548                         break;
549                 }
550         }
551
552         freeaddrinfo(ai);
553
554         if(listen_sockets)
555                 logger(LOG_NOTICE, "Ready");
556         else {
557                 logger(LOG_ERR, "Unable to create any listening socket!");
558                 return false;
559         }
560
561         return true;
562 }
563
564 /*
565   initialize network
566 */
567 bool setup_network(void) {
568         init_connections();
569         init_subnets();
570         init_nodes();
571         init_edges();
572         init_requests();
573
574         if(get_config_int(lookup_config(config_tree, "PingInterval"), &pinginterval)) {
575                 if(pinginterval < 1) {
576                         pinginterval = 86400;
577                 }
578         } else
579                 pinginterval = 60;
580
581         if(!get_config_int(lookup_config(config_tree, "PingTimeout"), &pingtimeout))
582                 pingtimeout = 5;
583         if(pingtimeout < 1 || pingtimeout > pinginterval)
584                 pingtimeout = pinginterval;
585
586         if(!get_config_int(lookup_config(config_tree, "MaxOutputBufferSize"), &maxoutbufsize))
587                 maxoutbufsize = 10 * MTU;
588
589         if(!setup_myself())
590                 return false;
591
592         return true;
593 }
594
595 /*
596   close all open network connections
597 */
598 void close_network_connections(void) {
599         splay_node_t *node, *next;
600         connection_t *c;
601         char *envp[5];
602         int i;
603
604         for(node = connection_tree->head; node; node = next) {
605                 next = node->next;
606                 c = node->data;
607                 c->outgoing = false;
608                 terminate_connection(c, false);
609         }
610
611         list_delete_list(outgoing_list);
612
613         if(myself && myself->connection) {
614                 subnet_update(myself, NULL, false);
615                 terminate_connection(myself->connection, false);
616                 free_connection(myself->connection);
617         }
618
619         for(i = 0; i < listen_sockets; i++) {
620                 event_del(&listen_socket[i].ev_tcp);
621                 event_del(&listen_socket[i].ev_udp);
622                 close(listen_socket[i].tcp);
623                 close(listen_socket[i].udp);
624                 thread_destroy(&listen_socket[i].udp_thread);
625         }
626
627         xasprintf(&envp[0], "NETNAME=%s", netname ? : "");
628         xasprintf(&envp[1], "DEVICE=%s", device ? : "");
629         xasprintf(&envp[2], "INTERFACE=%s", iface ? : "");
630         xasprintf(&envp[3], "NAME=%s", myself->name);
631         envp[4] = NULL;
632
633         exit_requests();
634         exit_edges();
635         exit_subnets();
636         exit_nodes();
637         exit_connections();
638
639         execute_script("tinc-down", envp);
640
641         if(myport) free(myport);
642
643         for(i = 0; i < 4; i++)
644                 free(envp[i]);
645
646         close_device();
647
648         return;
649 }