ha_config.c

Go to the documentation of this file.

/* $Id: ha_config.c,v 1.27 2001/10/20 10:16:11 jm Exp $
 * Home Agent - configuration reading routines
 *
 * Dynamic hierarchial IP tunnel
 * Copyright (C) 1998-2001, Dynamics group
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation. See README and COPYING for
 * more details.
 */

#include <stdlib.h>
#include <stdio.h>
#include <assert.h>
#include <string.h>
#include <syslog.h>
#include <unistd.h>

#include "auth.h"
#include "ha_config.h"
#include "ha.h"
#include "fileio.h"
#include "util.h"

#define ASSERT assert

struct load_ha_data {
        struct ha_config *cfg;
        int process_spi_list;
        int process_authorized_list;
        int process_fa_spi_list;
        int process_interfaces;
};

static int process_load_ha(void *voidptr, char *key, char *data);
static int process_load_ha_spi_list(struct load_ha_data *ha, char *key,
                                    char *data);
static int process_load_ha_authorized_list(struct load_ha_data *ha, char *key,
                                           char *data);
static int process_load_fa_spi_list(struct load_ha_data *ha, char *key,
                                    char *data);

/* clean up home agent configuration settings */

void
cleanup_config(struct ha_config *cfg)
{
        struct spi_entry *spi;
        struct fa_spi_entry *fa_spi;
        struct authorized_entry *auth;
        struct interface_entry *iface;

        if (cfg == NULL) return;

        spi = (struct spi_entry *) list_remove_first(&cfg->spi_list);
        while (spi != NULL) {
                free(spi);
                spi = (struct spi_entry *) list_remove_first(&cfg->spi_list);
        }

        /* remove all from authorized list */
        auth = (struct authorized_entry *)
                list_remove_first(&cfg->authorized_list);
        while (auth != NULL) {
                free(auth);
                auth = (struct authorized_entry *)
                        list_remove_first(&cfg->authorized_list);
        }

        fa_spi = (struct fa_spi_entry *) list_remove_first(&cfg->fa_spi_list);
        while (fa_spi != NULL) {
                free(fa_spi);
                fa_spi = (struct fa_spi_entry *)
                        list_remove_first(&cfg->fa_spi_list);
        }

        iface = (struct interface_entry *)
                list_remove_first(&cfg->interfaces);
        while (iface != NULL) {
                if (iface->icmp_sock >= 0)
                        close(iface->icmp_sock);
                if (iface->udp_sock >= 0)
                        close(iface->udp_sock);
                if (iface->udp_bc_sock >= 0)
                        close(iface->udp_bc_sock);
                if (iface->udp_bc_sock2 >= 0)
                        close(iface->udp_bc_sock2);
                free(iface);
                iface = (struct interface_entry *)
                        list_remove_first(&cfg->interfaces);
        }
}


int
load_config(struct ha_config *cfg, char *program_name, char *config_file)
{
        FILE *file;
        struct load_ha_data ha;

        ASSERT(cfg);
        ha.cfg = cfg;
        memset(cfg, 0, sizeof(struct ha_config));
        ha.process_spi_list = FALSE;
        list_init(&cfg->spi_list);
        ha.process_authorized_list = FALSE;
        list_init(&cfg->authorized_list);
        ha.process_fa_spi_list = FALSE;
        list_init(&cfg->fa_spi_list);
        ha.process_interfaces = FALSE;
        list_init(&cfg->interfaces);

        /* set default values */
        cfg->max_bindings = HA_DEFAULT_MAX_BINDINGS;
        cfg->ha_default_tunnel_lifetime = HA_DEFAULT_TUNNEL_LIFETIME;
        cfg->reg_error_reply_interval = HA_DEFAULT_REG_ERROR_REPLY_INTERVAL;
        cfg->syslog_facility = HA_DEFAULT_SYSLOG_FACILITY;
        cfg->udpport = HA_DEFAULT_REG_PORT;
        cfg->socket_priority = -1;
        cfg->enable_triangle_tunneling = TRUE;
        cfg->enable_reverse_tunneling = TRUE;
        cfg->pubkey_hash_method = HASH_METHOD_CHECK;

        file = fopen(config_file, "r");
        if (file == NULL) {
                fprintf(stderr,
                        "%s: Could not open configuration file '%s'.\n",
                        program_name, config_file);
                return FALSE;
        }
        if (load_data(&ha, file, process_load_ha) == FALSE) {
                fprintf(stderr,
                        "%s: Error while interpreting file '%s'!\n",
                        program_name, config_file);
                fclose(file);
                cleanup_config(cfg);
                return FALSE;
        }
        fclose(file);

        openlog("home agent", LOG_PID | LOG_CONS, cfg->syslog_facility);

        return TRUE;
}


static int
process_interfaces(struct load_ha_data *ha, char *key, char *data)
{
        struct ha_config *cfg;
        struct interface_entry *iface;
        char *pos;

        if (strcmp(key, "INTERFACES_END") == 0) {
                assert(ha->process_interfaces == TRUE);
                ha->process_interfaces = FALSE;
                return 0;
        }

        cfg = ha->cfg;
        iface = malloc(sizeof(struct interface_entry));
        if (iface == NULL) {
                fprintf(stderr,
                        "process_interfaces: not enough memory for "
                        "struct interface_entry\n");
                return -1;
        }
        memset(iface, 0, sizeof(iface));
        list_init_node(&iface->node);

        dynamics_strlcpy(iface->dev, key, IFNAMSIZ);

        pos = data;
        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' || sscanf(pos, "%d", &iface->ha_disc) != 1 ||
            (iface->ha_disc < 0 || iface->ha_disc > 1)) {
                fprintf(stderr,
                        "process_interfaces: invalid ha_disc (interface=%s)\n",
                        iface->dev);
                free(iface);
                return -1;
        }

        while (*pos != ' ' && *pos != '\t' && *pos != '\0') pos++;
        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' || sscanf(pos, "%d", &iface->agentadv) != 1) {
                fprintf(stderr, "process_interfaces: invalid agentadv "
                        "(interface=%s)\n", iface->dev);
                free(iface);
                return -1;
        }

        while (*pos != ' ' && *pos != '\t' && *pos != '\0') pos++;
        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' || sscanf(pos, "%d", &iface->interval) != 1) {
                fprintf(stderr, "process_interfaces: invalid interval "
                        "(interface=%s)\n", iface->dev);
                free(iface);
                return -1;
        }

        if (iface->interval < 1) {
                fprintf(stderr, "process_interfaces: advertisement interval "
                        "too short (must be at least one second)\n");
                free(iface);
                return -1;
        }

        while (*pos != ' ' && *pos != '\t' && *pos != '\0') pos++;
        while (*pos == ' ' || *pos == '\t') pos++;
        iface->force_addr.s_addr = 0;
        if (*pos != '\0' && load_ip_address(pos, &iface->force_addr) != TRUE) {
                fprintf(stderr, "process_interfaces: invalid IP address "
                        "(interface=%s)\n", iface->dev);
                free(iface);
                return -1;
        }

        iface->icmp_sock = -1;
        iface->udp_sock = -1;
        iface->udp_bc_sock = -1;
        iface->udp_bc_sock2 = -1;
        list_add_tail(&cfg->interfaces, &iface->node);

        return 0;
}


/*
 * process_load_ha
 *
 * Process loading of the ha_data
 *
 * Return values:
 *  -2: consistency error,
 *  -1: error,
 *   0: ok,
 *   1: end
 */
static int process_load_ha(void *voidptr, char *key, char *data)
{
        struct load_ha_data *ha;
        struct ha_config *cfg;

        ha = voidptr;
        cfg = ha->cfg;

        if (ha->process_spi_list == TRUE) {
                return process_load_ha_spi_list(ha, key, data);
        }
        if (ha->process_authorized_list == TRUE) {
                return process_load_ha_authorized_list(ha, key, data);
        }
        if (ha->process_fa_spi_list == TRUE) {
                return process_load_fa_spi_list(ha, key, data);
        }
        if (ha->process_interfaces == TRUE) {
                return process_interfaces(ha, key, data);
        }
        if (strcmp(key, "MaxBindings") == 0) {
                if (load_int(data, &cfg->max_bindings) == TRUE) return 0;
                return -1;
        }
        if (strcmp(key, "HADefaultTunnelLifetime") == 0) {
                if (load_int(data, &cfg->ha_default_tunnel_lifetime) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "RegErrorReplyInterval") == 0) {
                if (load_int(data, &cfg->reg_error_reply_interval) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "SECURITY_BEGIN") == 0) {
                if (ha->process_authorized_list ||
                    ha->process_spi_list ||
                    ha->process_fa_spi_list || ha->process_interfaces) {
                        fprintf(stderr, "List processing error while handling "
                                "SECURITY_BEGIN\n");
                        return -1;
                }
                ha->process_spi_list = TRUE;
                return 0;
        }
        if (strcmp(key, "AUTHORIZEDLIST_BEGIN") == 0) {
                if (ha->process_authorized_list ||
                    ha->process_spi_list ||
                    ha->process_fa_spi_list || ha->process_interfaces) {
                        fprintf(stderr, "List processing error while handling "
                                "AUTHORIZEDLIST_BEGIN\n");
                        return -1;
                }
                ha->process_authorized_list = TRUE;
                return 0;
        }
        if (strcmp(key, "FA_SECURITY_BEGIN") == 0) {
                if (ha->process_authorized_list ||
                    ha->process_spi_list ||
                    ha->process_fa_spi_list || ha->process_interfaces) {
                        fprintf(stderr, "List processing error while handling "
                                "FA_SECURITY_BEGIN\n");
                        return -1;
                }
                ha->process_fa_spi_list = TRUE;
                return 0;
        }
        if (strcmp(key, "INTERFACES_BEGIN") == 0) {
                if (ha->process_authorized_list ||
                    ha->process_spi_list ||
                    ha->process_fa_spi_list || ha->process_interfaces) {
                        fprintf(stderr, "List processing error while handling "
                                "INTERFACES_BEGIN\n");
                        return -1;
                }
                ha->process_interfaces = TRUE;
                return 0;
        }
        if (strcmp(key, "SyslogFacility") == 0) {
                if (load_syslog_facility(data,
                                         &cfg->syslog_facility) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "HAAPIReadSocketPath") == 0) {
                if (load_char_table(data, cfg->ha_api_read_socket_path,
                                    MAXFILENAMELEN) == TRUE) {
                        return 0;
                }
                return -1;
        }


        if (strcmp(key, "HAAPIReadSocketGroup") == 0) {
                if (load_char_table(data, cfg->ha_api_read_socket_group,
                                    MAXGROUPNAMELEN) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "HAAPIReadSocketOwner") == 0) {
                if (load_char_table(data, cfg->ha_api_read_socket_owner,
                                    MAXOWNERNAMELEN) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "HAAPIReadSocketPermissions") == 0) {
                if (load_int(data,
                             &cfg->ha_api_read_socket_permissions) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "HAAPIAdminSocketPath") == 0) {
                if (load_char_table(data, cfg->ha_api_admin_socket_path,
                                    MAXFILENAMELEN) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "HAAPIAdminSocketGroup") == 0) {
                if (load_char_table(data, cfg->ha_api_admin_socket_group,
                                    MAXGROUPNAMELEN) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "HAAPIAdminSocketOwner") == 0) {
                if (load_char_table(data, cfg->ha_api_admin_socket_owner,
                                    MAXOWNERNAMELEN) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "HAAPIAdminSocketPermissions") == 0) {
                if (load_int(data,
                             &cfg->ha_api_admin_socket_permissions) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "UDPPort") == 0) {
                if (load_int(data, &cfg->udpport) == TRUE) 
                        return 0;
                return -1;
        }
        if (strcmp(key, "SocketPriority") == 0) {
                if (load_int(data, &cfg->socket_priority) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "EnableTriangleTunneling") == 0) {
                if (load_bool(data, &cfg->enable_triangle_tunneling) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "EnableReverseTunneling") == 0) {
                if (load_bool(data, &cfg->enable_reverse_tunneling) == TRUE) {
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "PublicKeyHashMethod") == 0) {
                if (load_int(data, &cfg->pubkey_hash_method) == TRUE) {
                        if (cfg->pubkey_hash_method != HASH_METHOD_NONE &&
                            cfg->pubkey_hash_method != HASH_METHOD_CHECK &&
                            cfg->pubkey_hash_method != HASH_METHOD_REQUIRE) {
                                fprintf(stderr,
                                        "Invalid PublicKeyHashMethod %i\n",
                                        cfg->pubkey_hash_method);
                                return -1;
                        }
                        return 0;
                }
                return -1;
        }
        if (strcmp(key, "SHAIPAddress") == 0) {
                if (load_ip_address(data, &cfg->sha_addr) == TRUE)
                        return 0;
                return -1;
        }
        if (strcmp(key, "PrivateHAIdentifier") == 0) {
                if (load_int(data, (int *) &cfg->priv_ha) == TRUE)
                        return 0;
                return -1;
        }
        if (strcmp(key, "NetworkAccessIdentifier") == 0) {
                if (load_nai(data, cfg->ha_nai, &cfg->ha_nai_len) == TRUE)
                        return 0;
                return -1;
        }

        if (strcmp(key, "dhcp") == 0) {
                if (load_char_table(data, cfg->dhcp_if,
                                    MAXFILENAMELEN) == TRUE) {
                        return 0;
                }
                return -1;
        }

        if (strcmp(key, "END") == 0) return 1;
        return -1;
}

/* process ha spi list */

static int process_load_ha_spi_list(struct load_ha_data *ha, char *key,
                                    char *data)
{
        struct ha_config *cfg;
        struct spi_entry *spi;
        char *pos;
        int res;

        if (strcmp(key, "SECURITY_END") == 0) {
                ASSERT(ha->process_spi_list == TRUE);
                ha->process_spi_list = FALSE;
                return 0;
        }

        cfg = ha->cfg;
        spi = malloc(sizeof(struct spi_entry));
        if (spi == NULL) {
                fprintf(stderr,
                        "process_load_ha_spi_list: not enough memory for "
                        "struct spi_entry\n");
                return -1;
        }

        if (key[0] == '0' && key[1] == 'x')
                res = sscanf(key, "%x", &spi->spi);
        else
                res = sscanf(key, "%d", &spi->spi);

        if (res != 1) {
                fprintf(stderr,
                        "process_load_ha_spi_list: invalid SPI number\n");
                free(spi);
                return -1;
        }
        list_init_node(&spi->node);

        pos = data;

        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' || sscanf(pos, "%d", &spi->auth_alg) != 1) {
                fprintf(stderr,
                        "process_load_ha_spi_list: invalid authentication "
                        "algorithm number\n");
                free(spi);
                return -1;
        }
        if (!auth_supported_auth_alg(spi->auth_alg)) {
                fprintf(stderr, "process_load_ha_spi_list: unsupported "
                        "authentication algorithm %i\n", spi->auth_alg);
                free(spi);
                return -1;
        }

        while (*pos != ' ' && *pos != '\t' && *pos != '\0') pos++;
        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' || sscanf(pos, "%d", &spi->replay_method) != 1) {
                fprintf(stderr,
                        "process_load_ha_spi_list: invalid replay method "
                        "number\n");
                free(spi);
                return -1;
        }
        if (spi->replay_method < 0 || spi->replay_method > 2) {
                fprintf(stderr, "process_load_ha_spi_list: unsupported replay "
                        "method %i\n", spi->replay_method);
                free(spi);
                return -1;
        }

        while (*pos != ' ' && *pos != '\t' && *pos != '\0') pos++;
        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' ||
            sscanf(pos, "%d", &spi->timestamp_tolerance) != 1) {
                fprintf(stderr,
                        "process_load_ha_spi_list: invalid timestamp "
                        "tolerance\n");
                free(spi);
                return -1;
        }

        while (*pos != ' ' && *pos != '\t' && *pos != '\0') pos++;
        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' || sscanf(pos, "%d", &spi->max_lifetime) != 1) {
                fprintf(stderr,
                        "process_load_ha_spi_list: invalid maximum "
                        "lifetime\n");
                free(spi);
                return -1;
        }

        while (*pos != ' ' && *pos != '\t' && *pos != '\0') pos++;
        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' || load_hex_table(pos, spi->shared_secret,
                                           MAXSHAREDSECRETLEN,
                                           &spi->shared_secret_len) == FALSE) {
                fprintf(stderr,
                        "process_load_ha_spi_list: invalid shared secret\n");
                free(spi);
                return -1;
        }

        ASSERT(spi->shared_secret_len >= 0);
        ASSERT(spi->shared_secret_len <= MAXSHAREDSECRETLEN);
        list_add_tail(&cfg->spi_list, &spi->node);

        return 0;
}

/* process ha authenticated list */

static int process_load_ha_authorized_list(struct load_ha_data *ha, char *key,
                                           char *data)
{
        struct ha_config *cfg;
        struct authorized_entry *auth;

        if (strcmp(key, "AUTHORIZEDLIST_END") == 0) {
                ASSERT(ha->process_authorized_list == TRUE);
                ha->process_authorized_list = FALSE;
                return 0;
        }

        cfg = ha->cfg;
        auth = malloc(sizeof(struct authorized_entry));
        if (auth == NULL) {
                fprintf(stderr,
                        "process_load_ha_authorized_list: not enough memory "
                        "for struct authorized_entry\n");
                return -1;
        }
        list_init_node(&auth->node);
        if (sscanf(key, "%d-%d", &auth->spi_low, &auth->spi_high) == 2) {
                if (auth->spi_low > auth->spi_high) {
                        fprintf(stderr,
                                "process_load_ha_authorized_list: lower SPI "
                                "greater than higher SPI\n");
                        free(auth);
                        return -1;
                }
        } else if (sscanf(key, "%d", &auth->spi_low) == 1) {
                auth->spi_high = auth->spi_low;
        } else {
                fprintf(stderr,
                        "process_load_ha_authorized_list: invalid SPI '%s'\n",
                        key);
                free(auth);
                return -1;
        }
        while(*data == ' ' || *data == '\t') {
                data++;
        }
        if (load_net_address(data, &auth->network, &auth->netmask) != TRUE) {
                printf("process_load_ha_authorized_list: invalid "
                        "Mobile Node home IP network address\n");
                free(auth);
                return -1;
        }

        list_add_tail(&cfg->authorized_list, &auth->node);
        return 0;
}

static int process_load_fa_spi_list(struct load_ha_data *ha, char *key,
                                    char *data)
{
        struct ha_config *cfg;
        struct fa_spi_entry *spi;
        char *pos;
        int res;

        if (strcmp(key, "FA_SECURITY_END") == 0) {
                ASSERT(ha->process_fa_spi_list == TRUE);
                ha->process_fa_spi_list = FALSE;
                return 0;
        }

        cfg = ha->cfg;
        spi = malloc(sizeof(struct fa_spi_entry));
        if (spi == NULL) {
                fprintf(stderr,
                        "process_load_fa_spi_list: not enough memory for "
                        "struct spi_entry\n");
                return -1;
        }

        list_init_node(&spi->node);

        if (key[0] == '0' && key[1] == 'x')
                res = sscanf(key, "%x", &spi->spi);
        else
                res = sscanf(key, "%d", &spi->spi);

        if (res != 1) {
                fprintf(stderr,
                        "process_load_fa_spi_list: invalid SPI number\n");
                free(spi);
                return -1;
        }

        pos = data;

        while (*pos == ' ' || *pos == '\t') pos++;
        if (load_ip_address(pos, &spi->addr) != TRUE) {
                fprintf(stderr,
                        "process_load_fa_authorized_list: invalid "
                        "IP address\n");
                free(spi);
                return -1;
        }

        while (*pos != ' ' && *pos != '\t' && *pos != '\0') pos++;
        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' || sscanf(pos, "%d", &spi->alg) != 1) {
                fprintf(stderr,
                        "process_load_fa_spi_list: invalid algorithm "
                        "number\n");
                free(spi);
                return -1;
        }

        if (!auth_supported_auth_alg(spi->alg)) {
                fprintf(stderr, "process_load_fa_spi_list: unsupported "
                        "algorithm %i\n", spi->alg);
                free(spi);
                return -1;
        }

        while (*pos != ' ' && *pos != '\t' && *pos != '\0') pos++;
        while (*pos == ' ' || *pos == '\t') pos++;
        if (*pos == '\0' || load_hex_table(pos, spi->shared_secret,
                                           MAXSHAREDSECRETLEN,
                                           &spi->shared_secret_len) == FALSE) {
                fprintf(stderr,
                        "process_load_fa_spi_list: invalid shared secret\n");
                free(spi);
                return -1;
        }

        ASSERT(spi->shared_secret_len >= 0);
        ASSERT(spi->shared_secret_len <= MAXSHAREDSECRETLEN);
        list_add_tail(&cfg->fa_spi_list, &spi->node);

        return 0;
}

---