From 400ec0f57660314551769c94198dccf6a2dd40fe Mon Sep 17 00:00:00 2001 From: Pierre Pronchery Date: Fri, 27 Jul 2018 03:56:41 +0200 Subject: [PATCH] Add a command-line option to enable IPv6 (TCP/UDP) This is currently "--ipv6", or "-6" for short. --- server/cmd_opts.h | 5 +++-- server/config_init.c | 4 ++++ server/fwknopd.c | 4 ++-- server/fwknopd_common.h | 1 + server/pcap_capture.c | 2 +- 5 files changed, 11 insertions(+), 5 deletions(-) diff --git a/server/cmd_opts.h b/server/cmd_opts.h index a2feed5d..e51506df 100644 --- a/server/cmd_opts.h +++ b/server/cmd_opts.h @@ -181,9 +181,9 @@ enum { /* Our getopt_long options string. */ #if USE_LIBNETFILTER_QUEUE - #define GETOPTS_OPTION_STRING "Aa:c:C:d:Dfhi:Kl:nO:p:P:Rr:StUvV" + #define GETOPTS_OPTION_STRING "Aa:c:C:d:Dfhi:6Kl:nO:p:P:Rr:StUvV" #else - #define GETOPTS_OPTION_STRING "Aa:c:C:d:Dfhi:Kl:O:p:P:Rr:StUvV" + #define GETOPTS_OPTION_STRING "Aa:c:C:d:Dfhi:6Kl:O:p:P:Rr:StUvV" #endif /* Our program command-line options... @@ -206,6 +206,7 @@ static struct option cmd_opts[] = {"fault-injection-tag", 1, NULL, FAULT_INJECTION_TAG}, {"help", 0, NULL, 'h'}, {"interface", 1, NULL, 'i'}, + {"ipv6", 0, NULL, '6'}, {"key-gen", 0, NULL, 'k'}, {"key-gen-file", 1, NULL, KEY_GEN_FILE }, {"key-len", 1, NULL, KEY_LEN }, diff --git a/server/config_init.c b/server/config_init.c index 7f231336..4a412905 100644 --- a/server/config_init.c +++ b/server/config_init.c @@ -1372,6 +1372,9 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) case 'i': set_config_entry(opts, CONF_PCAP_INTF, optarg); break; + case '6': + opts->ipv6 = 1; + break; case FIREWD_DISABLE_CHECK_SUPPORT: opts->firewd_disable_check_support = 1; break; @@ -1498,6 +1501,7 @@ usage(void) " a background daemon).\n" " -i, --interface - Specify interface to listen for incoming SPA\n" " packets.\n" + " -6, --ipv6 - Start the server in IPv6 mode (TCP/UDP).\n" " -C, --packet-limit - Limit the number of candidate SPA packets to\n" " process and exit when this limit is reached.\n" " -d, --digest-file - Specify an alternate digest.cache file.\n" diff --git a/server/fwknopd.c b/server/fwknopd.c index bd3abef5..7956d6b0 100644 --- a/server/fwknopd.c +++ b/server/fwknopd.c @@ -259,7 +259,7 @@ main(int argc, char **argv) if(opts.enable_udp_server || strncasecmp(opts.config[CONF_ENABLE_UDP_SERVER], "Y", 1) == 0) { - if(run_udp_server(&opts, AF_INET) < 0) + if(run_udp_server(&opts, opts.ipv6 ? AF_INET6 : AF_INET) < 0) { log_msg(LOG_ERR, "Fatal run_udp_server() error"); clean_exit(&opts, FW_CLEANUP, EXIT_FAILURE); @@ -280,7 +280,7 @@ main(int argc, char **argv) */ if(strncasecmp(opts.config[CONF_ENABLE_TCP_SERVER], "Y", 1) == 0) { - if(run_tcp_server(&opts, AF_INET) < 0) + if(run_tcp_server(&opts, opts.ipv6 ? AF_INET6 : AF_INET) < 0) { log_msg(LOG_ERR, "Fatal run_tcp_server() error"); clean_exit(&opts, FW_CLEANUP, EXIT_FAILURE); diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h index 3ce6b726..6c1396a3 100644 --- a/server/fwknopd_common.h +++ b/server/fwknopd_common.h @@ -685,6 +685,7 @@ typedef struct fko_srv_options unsigned char enable_nfq_capture; /* Enable Netfilter Queue capture mode */ unsigned char enable_fw; /* Command modes by themselves don't need firewall support. */ + unsigned char ipv6; /* Enable IPv6 mode (TCP/UDP) */ unsigned char firewd_disable_check_support; /* Don't use firewall-cmd ... -C */ unsigned char ipt_disable_check_support; /* Don't use iptables -C */ diff --git a/server/pcap_capture.c b/server/pcap_capture.c index 73678feb..f32aeca8 100644 --- a/server/pcap_capture.c +++ b/server/pcap_capture.c @@ -211,7 +211,7 @@ pcap_capture(fko_srv_options_t *opts) /* Attempt to restart tcp server ? */ usleep(1000000); - run_tcp_server(opts, AF_INET); + run_tcp_server(opts, opts->ipv6 ? AF_INET6 : AF_INET); } }