Support ToS/DiffServ priority handling for IPv6 meta and UDP connections.
[tinc] / src / net_setup.c
1 /*
2     net_setup.c -- Setup.
3     Copyright (C) 1998-2005 Ivo Timmermans,
4                   2000-2014 Guus Sliepen <guus@tinc-vpn.org>
5                   2006      Scott Lamb <slamb@slamb.org>
6                   2010      Brandon Black <blblack@gmail.com>
7
8     This program is free software; you can redistribute it and/or modify
9     it under the terms of the GNU General Public License as published by
10     the Free Software Foundation; either version 2 of the License, or
11     (at your option) any later version.
12
13     This program is distributed in the hope that it will be useful,
14     but WITHOUT ANY WARRANTY; without even the implied warranty of
15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16     GNU General Public License for more details.
17
18     You should have received a copy of the GNU General Public License along
19     with this program; if not, write to the Free Software Foundation, Inc.,
20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22
23 #include "system.h"
24
25 #include <openssl/pem.h>
26 #include <openssl/rsa.h>
27 #include <openssl/rand.h>
28 #include <openssl/err.h>
29 #include <openssl/evp.h>
30
31 #include "avl_tree.h"
32 #include "conf.h"
33 #include "connection.h"
34 #include "device.h"
35 #include "event.h"
36 #include "graph.h"
37 #include "logger.h"
38 #include "net.h"
39 #include "netutl.h"
40 #include "process.h"
41 #include "protocol.h"
42 #include "route.h"
43 #include "subnet.h"
44 #include "utils.h"
45 #include "xalloc.h"
46
47 char *myport;
48 devops_t devops;
49
50 char *proxyhost;
51 char *proxyport;
52 char *proxyuser;
53 char *proxypass;
54 proxytype_t proxytype;
55
56 bool read_rsa_public_key(connection_t *c) {
57         FILE *fp;
58         char *pubname;
59         char *hcfname;
60         char *key;
61
62         if(!c->rsa_key) {
63                 c->rsa_key = RSA_new();
64 //              RSA_blinding_on(c->rsa_key, NULL);
65         }
66
67         /* First, check for simple PublicKey statement */
68
69         if(get_config_string(lookup_config(c->config_tree, "PublicKey"), &key)) {
70                 if(BN_hex2bn(&c->rsa_key->n, key) != strlen(key)) {
71                         logger(LOG_ERR, "Invalid PublicKey for %s!", c->name);
72                         return false;
73                 }
74                 BN_hex2bn(&c->rsa_key->e, "FFFF");
75                 free(key);
76                 return true;
77         }
78
79         /* Else, check for PublicKeyFile statement and read it */
80
81         if(get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &pubname)) {
82                 fp = fopen(pubname, "r");
83
84                 if(!fp) {
85                         logger(LOG_ERR, "Error reading RSA public key file `%s': %s", pubname, strerror(errno));
86                         free(pubname);
87                         return false;
88                 }
89
90                 c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL);
91                 fclose(fp);
92
93                 if(c->rsa_key) {
94                         free(pubname);
95                         return true;            /* Woohoo. */
96                 }
97
98                 /* If it fails, try PEM_read_RSA_PUBKEY. */
99                 fp = fopen(pubname, "r");
100
101                 if(!fp) {
102                         logger(LOG_ERR, "Error reading RSA public key file `%s': %s", pubname, strerror(errno));
103                         free(pubname);
104                         return false;
105                 }
106
107                 c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL);
108                 fclose(fp);
109
110                 if(c->rsa_key) {
111 //                              RSA_blinding_on(c->rsa_key, NULL);
112                         free(pubname);
113                         return true;
114                 }
115
116                 logger(LOG_ERR, "Reading RSA public key file `%s' failed: %s", pubname, strerror(errno));
117                 free(pubname);
118                 return false;
119         }
120
121         /* Else, check if a harnessed public key is in the config file */
122
123         xasprintf(&hcfname, "%s/hosts/%s", confbase, c->name);
124         fp = fopen(hcfname, "r");
125
126         if(!fp) {
127                 logger(LOG_ERR, "Error reading RSA public key file `%s': %s", hcfname, strerror(errno));
128                 free(hcfname);
129                 return false;
130         }
131
132         c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL);
133         fclose(fp);
134
135         if(c->rsa_key) {
136                 free(hcfname);
137                 return true;
138         }
139
140         /* Try again with PEM_read_RSA_PUBKEY. */
141
142         fp = fopen(hcfname, "r");
143
144         if(!fp) {
145                 logger(LOG_ERR, "Error reading RSA public key file `%s': %s", hcfname, strerror(errno));
146                 free(hcfname);
147                 return false;
148         }
149
150         free(hcfname);
151         c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL);
152 //      RSA_blinding_on(c->rsa_key, NULL);
153         fclose(fp);
154
155         if(c->rsa_key)
156                 return true;
157
158         logger(LOG_ERR, "No public key for %s specified!", c->name);
159
160         return false;
161 }
162
163 static bool read_rsa_private_key(void) {
164         FILE *fp;
165         char *fname, *key, *pubkey;
166
167         if(get_config_string(lookup_config(config_tree, "PrivateKey"), &key)) {
168                 myself->connection->rsa_key = RSA_new();
169 //              RSA_blinding_on(myself->connection->rsa_key, NULL);
170                 if(BN_hex2bn(&myself->connection->rsa_key->d, key) != strlen(key)) {
171                         logger(LOG_ERR, "Invalid PrivateKey for myself!");
172                         free(key);
173                         return false;
174                 }
175                 free(key);
176                 if(!get_config_string(lookup_config(config_tree, "PublicKey"), &pubkey)) {
177                         logger(LOG_ERR, "PrivateKey used but no PublicKey found!");
178                         return false;
179                 }
180                 if(BN_hex2bn(&myself->connection->rsa_key->n, pubkey) != strlen(pubkey)) {
181                         logger(LOG_ERR, "Invalid PublicKey for myself!");
182                         free(pubkey);
183                         return false;
184                 }
185                 free(pubkey);
186                 BN_hex2bn(&myself->connection->rsa_key->e, "FFFF");
187                 return true;
188         }
189
190         if(!get_config_string(lookup_config(config_tree, "PrivateKeyFile"), &fname))
191                 xasprintf(&fname, "%s/rsa_key.priv", confbase);
192
193         fp = fopen(fname, "r");
194
195         if(!fp) {
196                 logger(LOG_ERR, "Error reading RSA private key file `%s': %s",
197                            fname, strerror(errno));
198                 free(fname);
199                 return false;
200         }
201
202 #if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN)
203         struct stat s;
204
205         if(!fstat(fileno(fp), &s)) {
206                 if(s.st_mode & ~0100700)
207                         logger(LOG_WARNING, "Warning: insecure file permissions for RSA private key file `%s'!", fname);
208         } else {
209                 logger(LOG_WARNING, "Could not stat RSA private key file `%s': %s'", fname, strerror(errno));
210         }
211 #endif
212
213         myself->connection->rsa_key = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL);
214         fclose(fp);
215
216         if(!myself->connection->rsa_key) {
217                 logger(LOG_ERR, "Reading RSA private key file `%s' failed: %s",
218                            fname, strerror(errno));
219                 free(fname);
220                 return false;
221         }
222
223         free(fname);
224         return true;
225 }
226
227 /*
228   Read Subnets from all host config files
229 */
230 void load_all_subnets(void) {
231         DIR *dir;
232         struct dirent *ent;
233         char *dname;
234         char *fname;
235         avl_tree_t *config_tree;
236         config_t *cfg;
237         subnet_t *s, *s2;
238         node_t *n;
239
240         xasprintf(&dname, "%s/hosts", confbase);
241         dir = opendir(dname);
242         if(!dir) {
243                 logger(LOG_ERR, "Could not open %s: %s", dname, strerror(errno));
244                 free(dname);
245                 return;
246         }
247
248         while((ent = readdir(dir))) {
249                 if(!check_id(ent->d_name))
250                         continue;
251
252                 n = lookup_node(ent->d_name);
253                 #ifdef _DIRENT_HAVE_D_TYPE
254                 //if(ent->d_type != DT_REG)
255                 //      continue;
256                 #endif
257
258                 xasprintf(&fname, "%s/hosts/%s", confbase, ent->d_name);
259                 init_configuration(&config_tree);
260                 read_config_options(config_tree, ent->d_name);
261                 read_config_file(config_tree, fname);
262                 free(fname);
263
264                 if(!n) {
265                         n = new_node();
266                         n->name = xstrdup(ent->d_name);
267                         node_add(n);
268                 }
269
270                 for(cfg = lookup_config(config_tree, "Subnet"); cfg; cfg = lookup_config_next(config_tree, cfg)) {
271                         if(!get_config_subnet(cfg, &s))
272                                 continue;
273
274                         if((s2 = lookup_subnet(n, s))) {
275                                 s2->expires = -1;
276                         } else {
277                                 subnet_add(n, s);
278                         }
279                 }
280
281                 exit_configuration(&config_tree);
282         }
283
284         closedir(dir);
285 }
286
287 char *get_name(void) {
288         char *name = NULL;
289
290         get_config_string(lookup_config(config_tree, "Name"), &name);
291
292         if(!name)
293                 return NULL;
294
295         if(*name == '$') {
296                 char *envname = getenv(name + 1);
297                 char hostname[32] = "";
298                 if(!envname) {
299                         if(strcmp(name + 1, "HOST")) {
300                                 fprintf(stderr, "Invalid Name: environment variable %s does not exist\n", name + 1);
301                                 free(name);
302                                 return false;
303                         }
304                         if(gethostname(hostname, sizeof hostname) || !*hostname) {
305                                 fprintf(stderr, "Could not get hostname: %s\n", strerror(errno));
306                                 free(name);
307                                 return false;
308                         }
309                         hostname[31] = 0;
310                         envname = hostname;
311                 }
312                 free(name);
313                 name = xstrdup(envname);
314                 for(char *c = name; *c; c++)
315                         if(!isalnum(*c))
316                                 *c = '_';
317         }
318
319         if(!check_id(name)) {
320                 logger(LOG_ERR, "Invalid name for myself!");
321                 free(name);
322                 return false;
323         }
324
325         return name;
326 }
327
328 /*
329   Configure node_t myself and set up the local sockets (listen only)
330 */
331 static bool setup_myself(void) {
332         config_t *cfg;
333         subnet_t *subnet;
334         char *name, *hostname, *mode, *afname, *cipher, *digest, *type;
335         char *fname = NULL;
336         char *address = NULL;
337         char *proxy = NULL;
338         char *space;
339         char *envp[5] = {NULL};
340         struct addrinfo *ai, *aip, hint = {0};
341         bool choice;
342         int i, err;
343         int replaywin_int;
344         bool port_specified = false;
345
346         myself = new_node();
347         myself->connection = new_connection();
348
349         myself->hostname = xstrdup("MYSELF");
350         myself->connection->hostname = xstrdup("MYSELF");
351
352         myself->connection->options = 0;
353         myself->connection->protocol_version = PROT_CURRENT;
354
355         if(!(name = get_name())) {
356                 logger(LOG_ERR, "Name for tinc daemon required!");
357                 return false;
358         }
359
360         /* Read tinc.conf and our own host config file */
361
362         myself->name = name;
363         myself->connection->name = xstrdup(name);
364         xasprintf(&fname, "%s/hosts/%s", confbase, name);
365         read_config_options(config_tree, name);
366         read_config_file(config_tree, fname);
367         free(fname);
368
369         if(!read_rsa_private_key())
370                 return false;
371
372         if(!get_config_string(lookup_config(config_tree, "Port"), &myport))
373                 myport = xstrdup("655");
374         else
375                 port_specified = true;
376
377         /* Ensure myport is numeric */
378
379         if(!atoi(myport)) {
380                 struct addrinfo *ai = str2addrinfo("localhost", myport, SOCK_DGRAM);
381                 sockaddr_t sa;
382                 if(!ai || !ai->ai_addr)
383                         return false;
384                 free(myport);
385                 memcpy(&sa, ai->ai_addr, ai->ai_addrlen);
386                 sockaddr2str(&sa, NULL, &myport);
387         }
388
389         if(get_config_string(lookup_config(config_tree, "Proxy"), &proxy)) {
390                 if((space = strchr(proxy, ' ')))
391                         *space++ = 0;
392
393                 if(!strcasecmp(proxy, "none")) {
394                         proxytype = PROXY_NONE;
395                 } else if(!strcasecmp(proxy, "socks4")) {
396                         proxytype = PROXY_SOCKS4;
397                 } else if(!strcasecmp(proxy, "socks4a")) {
398                         proxytype = PROXY_SOCKS4A;
399                 } else if(!strcasecmp(proxy, "socks5")) {
400                         proxytype = PROXY_SOCKS5;
401                 } else if(!strcasecmp(proxy, "http")) {
402                         proxytype = PROXY_HTTP;
403                 } else if(!strcasecmp(proxy, "exec")) {
404                         proxytype = PROXY_EXEC;
405                 } else {
406                         logger(LOG_ERR, "Unknown proxy type %s!", proxy);
407                         free(proxy);
408                         return false;
409                 }
410
411                 switch(proxytype) {
412                         case PROXY_NONE:
413                         default:
414                                 break;
415
416                         case PROXY_EXEC:
417                                 if(!space || !*space) {
418                                         logger(LOG_ERR, "Argument expected for proxy type exec!");
419                                         free(proxy);
420                                         return false;
421                                 }
422                                 proxyhost =  xstrdup(space);
423                                 break;
424
425                         case PROXY_SOCKS4:
426                         case PROXY_SOCKS4A:
427                         case PROXY_SOCKS5:
428                         case PROXY_HTTP:
429                                 proxyhost = space;
430                                 if(space && (space = strchr(space, ' ')))
431                                         *space++ = 0, proxyport = space;
432                                 if(space && (space = strchr(space, ' ')))
433                                         *space++ = 0, proxyuser = space;
434                                 if(space && (space = strchr(space, ' ')))
435                                         *space++ = 0, proxypass = space;
436                                 if(!proxyhost || !*proxyhost || !proxyport || !*proxyport) {
437                                         logger(LOG_ERR, "Host and port argument expected for proxy!");
438                                         free(proxy);
439                                         return false;
440                                 }
441                                 proxyhost = xstrdup(proxyhost);
442                                 proxyport = xstrdup(proxyport);
443                                 if(proxyuser && *proxyuser)
444                                         proxyuser = xstrdup(proxyuser);
445                                 if(proxypass && *proxypass)
446                                         proxypass = xstrdup(proxypass);
447                                 break;
448                 }
449
450                 free(proxy);
451         }
452
453         /* Read in all the subnets specified in the host configuration file */
454
455         cfg = lookup_config(config_tree, "Subnet");
456
457         while(cfg) {
458                 if(!get_config_subnet(cfg, &subnet))
459                         return false;
460
461                 subnet_add(myself, subnet);
462
463                 cfg = lookup_config_next(config_tree, cfg);
464         }
465
466         /* Check some options */
467
468         if(get_config_bool(lookup_config(config_tree, "IndirectData"), &choice) && choice)
469                 myself->options |= OPTION_INDIRECT;
470
471         if(get_config_bool(lookup_config(config_tree, "TCPOnly"), &choice) && choice)
472                 myself->options |= OPTION_TCPONLY;
473
474         if(myself->options & OPTION_TCPONLY)
475                 myself->options |= OPTION_INDIRECT;
476
477         get_config_bool(lookup_config(config_tree, "DirectOnly"), &directonly);
478         get_config_bool(lookup_config(config_tree, "StrictSubnets"), &strictsubnets);
479         get_config_bool(lookup_config(config_tree, "TunnelServer"), &tunnelserver);
480         get_config_bool(lookup_config(config_tree, "LocalDiscovery"), &localdiscovery);
481         strictsubnets |= tunnelserver;
482
483         if(get_config_string(lookup_config(config_tree, "Mode"), &mode)) {
484                 if(!strcasecmp(mode, "router"))
485                         routing_mode = RMODE_ROUTER;
486                 else if(!strcasecmp(mode, "switch"))
487                         routing_mode = RMODE_SWITCH;
488                 else if(!strcasecmp(mode, "hub"))
489                         routing_mode = RMODE_HUB;
490                 else {
491                         logger(LOG_ERR, "Invalid routing mode!");
492                         free(mode);
493                         return false;
494                 }
495                 free(mode);
496         }
497
498         if(get_config_string(lookup_config(config_tree, "Forwarding"), &mode)) {
499                 if(!strcasecmp(mode, "off"))
500                         forwarding_mode = FMODE_OFF;
501                 else if(!strcasecmp(mode, "internal"))
502                         forwarding_mode = FMODE_INTERNAL;
503                 else if(!strcasecmp(mode, "kernel"))
504                         forwarding_mode = FMODE_KERNEL;
505                 else {
506                         logger(LOG_ERR, "Invalid forwarding mode!");
507                         free(mode);
508                         return false;
509                 }
510                 free(mode);
511         }
512
513         choice = true;
514         get_config_bool(lookup_config(config_tree, "PMTUDiscovery"), &choice);
515         if(choice)
516                 myself->options |= OPTION_PMTU_DISCOVERY;
517
518         choice = true;
519         get_config_bool(lookup_config(config_tree, "ClampMSS"), &choice);
520         if(choice)
521                 myself->options |= OPTION_CLAMP_MSS;
522
523         get_config_bool(lookup_config(config_tree, "PriorityInheritance"), &priorityinheritance);
524         get_config_bool(lookup_config(config_tree, "DecrementTTL"), &decrement_ttl);
525         if(get_config_string(lookup_config(config_tree, "Broadcast"), &mode)) {
526                 if(!strcasecmp(mode, "no"))
527                         broadcast_mode = BMODE_NONE;
528                 else if(!strcasecmp(mode, "yes") || !strcasecmp(mode, "mst"))
529                         broadcast_mode = BMODE_MST;
530                 else if(!strcasecmp(mode, "direct"))
531                         broadcast_mode = BMODE_DIRECT;
532                 else {
533                         logger(LOG_ERR, "Invalid broadcast mode!");
534                         free(mode);
535                         return false;
536                 }
537                 free(mode);
538         }
539
540 #if !defined(SOL_IP) || !defined(IP_TOS)
541         if(priorityinheritance)
542                 logger(LOG_WARNING, "%s not supported on this platform for IPv4 connection", "PriorityInheritance");
543 #endif
544
545 #if !defined(IPPROTO_IPV6) || !defined(IPV6_TCLASS)
546         if(priorityinheritance)
547                 logger(LOG_WARNING, "%s not supported on this platform for IPv6 connection", "PriorityInheritance");
548 #endif
549
550         if(!get_config_int(lookup_config(config_tree, "MACExpire"), &macexpire))
551                 macexpire = 600;
552
553         if(get_config_int(lookup_config(config_tree, "MaxTimeout"), &maxtimeout)) {
554                 if(maxtimeout <= 0) {
555                         logger(LOG_ERR, "Bogus maximum timeout!");
556                         return false;
557                 }
558         } else
559                 maxtimeout = 900;
560
561         if(get_config_int(lookup_config(config_tree, "MinTimeout"), &mintimeout)) {
562                         if(mintimeout < 0) {
563                                 logger(LOG_ERR, "Bogus minimum timeout!");
564                                 return false;
565                         }
566                         if(mintimeout > maxtimeout) {
567                                 logger(LOG_WARNING, "Minimum timeout (%d s) cannot be larger than maximum timeout (%d s). Correcting !", mintimeout, maxtimeout );
568                                 mintimeout=maxtimeout;
569                         }
570                 } else
571                         mintimeout = 0;
572
573         if(get_config_int(lookup_config(config_tree, "UDPRcvBuf"), &udp_rcvbuf)) {
574                 if(udp_rcvbuf <= 0) {
575                         logger(LOG_ERR, "UDPRcvBuf cannot be negative!");
576                         return false;
577                 }
578         }
579
580         if(get_config_int(lookup_config(config_tree, "UDPSndBuf"), &udp_sndbuf)) {
581                 if(udp_sndbuf <= 0) {
582                         logger(LOG_ERR, "UDPSndBuf cannot be negative!");
583                         return false;
584                 }
585         }
586
587         if(get_config_int(lookup_config(config_tree, "ReplayWindow"), &replaywin_int)) {
588                 if(replaywin_int < 0) {
589                         logger(LOG_ERR, "ReplayWindow cannot be negative!");
590                         return false;
591                 }
592                 replaywin = (unsigned)replaywin_int;
593         }
594
595         if(get_config_string(lookup_config(config_tree, "AddressFamily"), &afname)) {
596                 if(!strcasecmp(afname, "IPv4"))
597                         addressfamily = AF_INET;
598                 else if(!strcasecmp(afname, "IPv6"))
599                         addressfamily = AF_INET6;
600                 else if(!strcasecmp(afname, "any"))
601                         addressfamily = AF_UNSPEC;
602                 else {
603                         logger(LOG_ERR, "Invalid address family!");
604                         free(afname);
605                         return false;
606                 }
607                 free(afname);
608         }
609
610         get_config_bool(lookup_config(config_tree, "Hostnames"), &hostnames);
611
612         /* Generate packet encryption key */
613
614         if(get_config_string(lookup_config(config_tree, "Cipher"), &cipher)) {
615                 if(!strcasecmp(cipher, "none")) {
616                         myself->incipher = NULL;
617                 } else {
618                         myself->incipher = EVP_get_cipherbyname(cipher);
619
620                         if(!myself->incipher) {
621                                 logger(LOG_ERR, "Unrecognized cipher type!");
622                                 free(cipher);
623                                 return false;
624                         }
625                 }
626                 free(cipher);
627         } else
628                 myself->incipher = EVP_bf_cbc();
629
630         if(myself->incipher)
631                 myself->inkeylength = myself->incipher->key_len + myself->incipher->iv_len;
632         else
633                 myself->inkeylength = 1;
634
635         myself->connection->outcipher = EVP_bf_ofb();
636
637         if(!get_config_int(lookup_config(config_tree, "KeyExpire"), &keylifetime))
638                 keylifetime = 3600;
639
640         keyexpires = now + keylifetime;
641         
642         /* Check if we want to use message authentication codes... */
643
644         if(get_config_string(lookup_config(config_tree, "Digest"), &digest)) {
645                 if(!strcasecmp(digest, "none")) {
646                         myself->indigest = NULL;
647                 } else {
648                         myself->indigest = EVP_get_digestbyname(digest);
649
650                         if(!myself->indigest) {
651                                 logger(LOG_ERR, "Unrecognized digest type!");
652                                 free(digest);
653                                 return false;
654                         }
655                 }
656
657                 free(digest);
658         } else
659                 myself->indigest = EVP_sha1();
660
661         myself->connection->outdigest = EVP_sha1();
662
663         if(get_config_int(lookup_config(config_tree, "MACLength"), &myself->inmaclength)) {
664                 if(myself->indigest) {
665                         if(myself->inmaclength > myself->indigest->md_size) {
666                                 logger(LOG_ERR, "MAC length exceeds size of digest!");
667                                 return false;
668                         } else if(myself->inmaclength < 0) {
669                                 logger(LOG_ERR, "Bogus MAC length!");
670                                 return false;
671                         }
672                 }
673         } else
674                 myself->inmaclength = 4;
675
676         myself->connection->outmaclength = 0;
677
678         /* Compression */
679
680         if(get_config_int(lookup_config(config_tree, "Compression"), &myself->incompression)) {
681                 if(myself->incompression < 0 || myself->incompression > 11) {
682                         logger(LOG_ERR, "Bogus compression level!");
683                         return false;
684                 }
685         } else
686                 myself->incompression = 0;
687
688         myself->connection->outcompression = 0;
689
690         /* Done */
691
692         myself->nexthop = myself;
693         myself->via = myself;
694         myself->status.reachable = true;
695         node_add(myself);
696
697         graph();
698
699         if(strictsubnets)
700                 load_all_subnets();
701
702         /* Open device */
703
704         devops = os_devops;
705
706         if(get_config_string(lookup_config(config_tree, "DeviceType"), &type)) {
707                 if(!strcasecmp(type, "dummy"))
708                         devops = dummy_devops;
709                 else if(!strcasecmp(type, "raw_socket"))
710                         devops = raw_socket_devops;
711                 else if(!strcasecmp(type, "multicast"))
712                         devops = multicast_devops;
713 #ifdef ENABLE_UML
714                 else if(!strcasecmp(type, "uml"))
715                         devops = uml_devops;
716 #endif
717 #ifdef ENABLE_VDE
718                 else if(!strcasecmp(type, "vde"))
719                         devops = vde_devops;
720 #endif
721                 free(type);
722         }
723
724         if(!devops.setup())
725                 return false;
726
727         /* Run tinc-up script to further initialize the tap interface */
728         xasprintf(&envp[0], "NETNAME=%s", netname ? : "");
729         xasprintf(&envp[1], "DEVICE=%s", device ? : "");
730         xasprintf(&envp[2], "INTERFACE=%s", iface ? : "");
731         xasprintf(&envp[3], "NAME=%s", myself->name);
732
733 #ifdef HAVE_MINGW
734         Sleep(1000);
735 #endif
736 #ifdef HAVE_CYGWIN
737         sleep(1);
738 #endif
739         execute_script("tinc-up", envp);
740
741         for(i = 0; i < 4; i++)
742                 free(envp[i]);
743
744         /* Run subnet-up scripts for our own subnets */
745
746         subnet_update(myself, NULL, true);
747
748         /* Open sockets */
749
750         if(!do_detach && getenv("LISTEN_FDS")) {
751                 sockaddr_t sa;
752                 socklen_t salen;
753
754                 listen_sockets = atoi(getenv("LISTEN_FDS"));
755 #ifdef HAVE_UNSETENV
756                 unsetenv("LISTEN_FDS");
757 #endif
758
759                 if(listen_sockets > MAXSOCKETS) {
760                         logger(LOG_ERR, "Too many listening sockets");
761                         return false;
762                 }
763
764                 for(i = 0; i < listen_sockets; i++) {
765                         salen = sizeof sa;
766                         if(getsockname(i + 3, &sa.sa, &salen) < 0) {
767                                 logger(LOG_ERR, "Could not get address of listen fd %d: %s", i + 3, sockstrerror(errno));
768                                 return false;
769                         }
770
771                         listen_socket[i].tcp = i + 3;
772
773 #ifdef FD_CLOEXEC
774                         fcntl(i + 3, F_SETFD, FD_CLOEXEC);
775 #endif
776
777                         listen_socket[i].udp = setup_vpn_in_socket(&sa);
778                         if(listen_socket[i].udp < 0)
779                                 return false;
780
781                         ifdebug(CONNECTIONS) {
782                                 hostname = sockaddr2hostname(&sa);
783                                 logger(LOG_NOTICE, "Listening on %s", hostname);
784                                 free(hostname);
785                         }
786
787                         memcpy(&listen_socket[i].sa, &sa, salen);
788                 }
789         } else {
790                 listen_sockets = 0;
791                 cfg = lookup_config(config_tree, "BindToAddress");
792
793                 do {
794                         get_config_string(cfg, &address);
795                         if(cfg)
796                                 cfg = lookup_config_next(config_tree, cfg);
797
798                         char *port = myport;
799
800                         if(address) {
801                                 char *space = strchr(address, ' ');
802                                 if(space) {
803                                         *space++ = 0;
804                                         port = space;
805                                 }
806
807                                 if(!strcmp(address, "*"))
808                                         *address = 0;
809                         }
810
811                         hint.ai_family = addressfamily;
812                         hint.ai_socktype = SOCK_STREAM;
813                         hint.ai_protocol = IPPROTO_TCP;
814                         hint.ai_flags = AI_PASSIVE;
815
816                         err = getaddrinfo(address && *address ? address : NULL, port, &hint, &ai);
817                         free(address);
818
819                         if(err || !ai) {
820                                 logger(LOG_ERR, "System call `%s' failed: %s", "getaddrinfo",
821                                            gai_strerror(err));
822                                 return false;
823                         }
824
825                         for(aip = ai; aip; aip = aip->ai_next) {
826                                 if(listen_sockets >= MAXSOCKETS) {
827                                         logger(LOG_ERR, "Too many listening sockets");
828                                         return false;
829                                 }
830
831                                 listen_socket[listen_sockets].tcp =
832                                         setup_listen_socket((sockaddr_t *) aip->ai_addr);
833
834                                 if(listen_socket[listen_sockets].tcp < 0)
835                                         continue;
836
837                                 listen_socket[listen_sockets].udp =
838                                         setup_vpn_in_socket((sockaddr_t *) aip->ai_addr);
839
840                                 if(listen_socket[listen_sockets].udp < 0)
841                                         continue;
842
843                                 ifdebug(CONNECTIONS) {
844                                         hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr);
845                                         logger(LOG_NOTICE, "Listening on %s", hostname);
846                                         free(hostname);
847                                 }
848
849                                 memcpy(&listen_socket[listen_sockets].sa, aip->ai_addr, aip->ai_addrlen);
850                                 listen_sockets++;
851                         }
852
853                         freeaddrinfo(ai);
854                 } while(cfg);
855         }
856
857         if(!listen_sockets) {
858                 logger(LOG_ERR, "Unable to create any listening socket!");
859                 return false;
860         }
861
862         /* If no Port option was specified, set myport to the port used by the first listening socket. */
863
864         if(!port_specified) {
865                 sockaddr_t sa;
866                 socklen_t salen = sizeof sa;
867                 if(!getsockname(listen_socket[0].udp, &sa.sa, &salen)) {
868                         free(myport);
869                         sockaddr2str(&sa, NULL, &myport);
870                         if(!myport)
871                                 myport = xstrdup("655");
872                 }
873         }
874
875         /* Done. */
876
877         logger(LOG_NOTICE, "Ready");
878         return true;
879 }
880
881 /*
882   initialize network
883 */
884 bool setup_network(void) {
885         now = time(NULL);
886
887         init_events();
888         init_connections();
889         init_subnets();
890         init_nodes();
891         init_edges();
892         init_requests();
893
894         if(get_config_int(lookup_config(config_tree, "PingInterval"), &pinginterval)) {
895                 if(pinginterval < 1) {
896                         pinginterval = 86400;
897                 }
898         } else
899                 pinginterval = 60;
900
901         if(!get_config_int(lookup_config(config_tree, "PingTimeout"), &pingtimeout))
902                 pingtimeout = 5;
903         if(pingtimeout < 1 || pingtimeout > pinginterval)
904                 pingtimeout = pinginterval;
905
906         if(!get_config_int(lookup_config(config_tree, "MaxOutputBufferSize"), &maxoutbufsize))
907                 maxoutbufsize = 10 * MTU;
908
909         if(!setup_myself())
910                 return false;
911
912         return true;
913 }
914
915 /*
916   close all open network connections
917 */
918 void close_network_connections(void) {
919         avl_node_t *node, *next;
920         connection_t *c;
921         char *envp[5] = {NULL};
922         int i;
923
924         for(node = connection_tree->head; node; node = next) {
925                 next = node->next;
926                 c = node->data;
927                 c->outgoing = NULL;
928                 terminate_connection(c, false);
929         }
930
931         for(list_node_t *node = outgoing_list->head; node; node = node->next) {
932                 outgoing_t *outgoing = node->data;
933
934                 if(outgoing->event)
935                         event_del(outgoing->event);
936         }
937
938         list_delete_list(outgoing_list);
939
940         if(myself && myself->connection) {
941                 subnet_update(myself, NULL, false);
942                 terminate_connection(myself->connection, false);
943                 free_connection(myself->connection);
944         }
945
946         for(i = 0; i < listen_sockets; i++) {
947                 close(listen_socket[i].tcp);
948                 close(listen_socket[i].udp);
949         }
950
951         xasprintf(&envp[0], "NETNAME=%s", netname ? : "");
952         xasprintf(&envp[1], "DEVICE=%s", device ? : "");
953         xasprintf(&envp[2], "INTERFACE=%s", iface ? : "");
954         xasprintf(&envp[3], "NAME=%s", myself->name);
955
956         exit_requests();
957         exit_edges();
958         exit_subnets();
959         exit_nodes();
960         exit_connections();
961         exit_events();
962
963         execute_script("tinc-down", envp);
964
965         if(myport) free(myport);
966
967         for(i = 0; i < 4; i++)
968                 free(envp[i]);
969
970         devops.close();
971
972         return;
973 }