From b0e10065a0fb29693570b03daf19806814c0cea3 Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Wed, 7 May 2014 14:03:11 +0200
Subject: [PATCH] Support for the unix socket is now configurable.

---
 NEWS                |  7 +++----
 src/config.c        |  8 ++++++++
 src/main-ctl-unix.c | 12 ++++++++++++
 src/ocserv-args.def |  7 +++----
 src/vpn.h           |  1 +
 5 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/NEWS b/NEWS
index 25c09c52..9eb32822 100644
--- a/NEWS
+++ b/NEWS
@@ -1,8 +1,7 @@
-* Version 0.3.5 (unreleased)
+* Version 0.4.0 (unreleased)
 
-- Corrected issue in the stats reporting for resumed processes.
-- Added the STATS_DURATION script environment variable which reports
-  the duration of the session in seconds.
+- By default unix sockets are being used for the communication with
+  occtl, instead of D-BUS.
 
 
 * Version 0.3.4 (released 2014-05-01)
diff --git a/src/config.c b/src/config.c
index 9a0ea7b4..bdcb560b 100644
--- a/src/config.c
+++ b/src/config.c
@@ -81,6 +81,7 @@ static struct cfg_options available_options[] = {
 	{ .name = "cisco-client-compat", .type = OPTION_BOOLEAN, .mandatory = 0 },
 	{ .name = "use-utmp", .type = OPTION_BOOLEAN, .mandatory = 0 },
 	{ .name = "use-dbus", .type = OPTION_BOOLEAN, .mandatory = 0 },
+	{ .name = "use-occtl", .type = OPTION_BOOLEAN, .mandatory = 0 },
 	{ .name = "try-mtu-discovery", .type = OPTION_BOOLEAN, .mandatory = 0 },
 	{ .name = "ping-leases", .type = OPTION_BOOLEAN, .mandatory = 0 },
 	{ .name = "tls-priorities", .type = OPTION_STRING, .mandatory = 0 },
@@ -370,6 +371,13 @@ unsigned force_cert_auth;
 
 	READ_TF("use-utmp", config->use_utmp, 1);
 	READ_TF("use-dbus", config->use_dbus, 0);
+	if (config->use_dbus != 0)
+		fprintf(stderr, "note that 'use-dbus' was replaced by 'use-occtl'\n");
+
+	READ_TF("use-occtl", config->use_occtl, 0);
+	if (config->use_occtl == 0)
+		config->use_dbus = 0;
+
 	READ_TF("try-mtu-discovery", config->try_mtu, 0);
 	READ_TF("ping-leases", config->ping_leases, 0);
 
diff --git a/src/main-ctl-unix.c b/src/main-ctl-unix.c
index 443a8463..8a899d54 100644
--- a/src/main-ctl-unix.c
+++ b/src/main-ctl-unix.c
@@ -80,6 +80,9 @@ static const ctl_method_st methods[] = {
 
 void ctl_handler_deinit(main_server_st * s)
 {
+	if (s->config->use_occtl == 0)
+		return;
+
 	if (s->ctl_fd >= 0) {
 		mslog(s, NULL, LOG_DEBUG, "closing unix socket connection");
 		close(s->ctl_fd);
@@ -95,6 +98,9 @@ int ctl_handler_init(main_server_st * s)
 	struct sockaddr_un sa;
 	int sd, e;
 
+	if (s->config->use_occtl == 0)
+		return 0;
+
 	memset(&sa, 0, sizeof(sa));
 	sa.sun_family = AF_UNIX;
 	snprintf(sa.sun_path, sizeof(sa.sun_path), "%s", OCSERV_UNIX_NAME);
@@ -651,12 +657,18 @@ static void ctl_handle_commands(main_server_st * s)
 
 int ctl_handler_set_fds(main_server_st * s, fd_set * rd_set, fd_set * wr_set)
 {
+	if (s->config->use_occtl == 0)
+		return -1;
+
 	FD_SET(s->ctl_fd, rd_set);
 	return s->ctl_fd;
 }
 
 void ctl_handler_run_pending(main_server_st* s, fd_set *rd_set, fd_set *wr_set)
 {
+	if (s->config->use_occtl == 0)
+		return;
+
 	if (FD_ISSET(s->ctl_fd, rd_set)) {
 		ctl_handle_commands(s);
 	}
diff --git a/src/ocserv-args.def b/src/ocserv-args.def
index 735366ec..3d558f54 100644
--- a/src/ocserv-args.def
+++ b/src/ocserv-args.def
@@ -245,10 +245,9 @@ rekey-method = ssl
 # the connected clients using the command 'who'.
 use-utmp = true
 
-# D-BUS usage. If disabled the occtl tool cannot be used. If enabled
-# then ocserv must have access to register org.infradead.ocserv
-# D-BUS service. See doc/dbus/org.infradead.ocserv.conf
-use-dbus = true
+# Whether to enable support for the occtl tool (i.e., either through D-BUS,
+# or via a unix socket).
+use-occtl = true
 
 # PID file. It can be overriden in the command line.
 pid-file = /var/run/ocserv.pid
diff --git a/src/vpn.h b/src/vpn.h
index b19e6be6..befcc42e 100644
--- a/src/vpn.h
+++ b/src/vpn.h
@@ -220,6 +220,7 @@ struct cfg_st {
 	unsigned max_same_clients;
 	unsigned use_utmp;
 	unsigned use_dbus; /* whether the D-BUS service is registered */
+	unsigned use_occtl; /* whether support for the occtl tool will be enabled */
 	unsigned try_mtu; /* MTU discovery enabled */
 	unsigned cisco_client_compat; /* do not require client certificate, 
 	                               * and allow auth to complete in different