Merge 1e6c57e989 into 32c3241de0

Dashboard2 XSS / Security fixes

.gitignore

@@ -2,3 +2,4 @@
 src/xlxd
 ambed/ambed
 ambedtest/ambedtest
+.DS_Store

README.md

@@ -78,9 +78,9 @@ Please use the stable version listed above, we cannot support others.
 # cp ~/xlxd/scripts/xlxd /etc/init.d/xlxd
 ```
 
-###### Adapt the default startup parameters to your needs
+###### Adapt the default configuration to your needs
 ```
-# pico /etc/init.d/xlxd
+# pico /xlxd/xlxd.config
 ```
 ###### Download the dmrid.dat from the XLXAPI server to your xlxd folder
 ```

config/xlxd.config

@@ -0,0 +1,15 @@
+#########################################################################################
+#  XLXD config file
+#
+#  one line per entry
+#  each entry specifies an option
+#
+#########################################################################################
+# the reflector callsign - default N0CALL
+callsign N0CALL
+
+# listening IP address - default 0.0.0.0
+listen 0.0.0.0
+
+# AMBE transcoder IP address - default 127.0.0.1
+transcoder 127.0.0.1

dashboard2/changes.txt

@@ -1,3 +1,28 @@
+xlx db v2.3.8
+
+SECURITY UPDATE - XSS Vulnerability Patches and Security Enhancements
+- "functions.php"       added SafeOutput() and SafeOutputAttr() for XSS protection
+                        added GenerateCSRFToken() and ValidateCSRFToken() for CSRF protection
+- "index.php"           added session_start() for CSRF token support
+                        added SafeOutput() to all $_GET['show'] outputs
+                        added input whitelist validation for $_GET['show'] parameter
+                        changed file permission from 777 to 600 for hash file (security hardening)
+                        added SafeOutputAttr() to all meta tag outputs
+                        added SafeOutput() to contact email output
+                        improved error messages to prevent information disclosure
+- "users.php"           added CSRF token validation for all POST requests
+                        added CSRF tokens to both filter forms
+                        added input validation with regex for callsign filter (alphanumeric, dash, asterisk only)
+                        added input validation with regex for module filter (single letter A-Z only)
+                        added SafeOutput() and SafeOutputAttr() to all user data outputs
+                        added SafeOutput() to all callsign, suffix, via, peer, and module outputs
+- "repeaters.php"       added SafeOutput() to all node callsign, suffix, protocol, and module outputs
+                        added SafeOutput() to all IP address outputs
+- "peers.php"           added SafeOutput() and SafeOutputAttr() to peer name and URL outputs
+                        added SafeOutput() to protocol, module, and IP address outputs
+- "reflectors.php"      added SafeOutput() and SafeOutputAttr() to reflector name, country, comment, and URL outputs
+- "class.reflector.php" added URL validation in CallHome() method to prevent remote file inclusion attacks
+
 xlx db v2.3.1
 
 - "config.inc.php" 	$CallingHome['InterlinkFile'] added
@@ -16,7 +41,7 @@ xlx db v2.2.2
 
 This version is a major release with voluntary self-registration feature build in.
 You need to edit the conf.inc.php to your needs.
-On the first run your personal hash to access the database is place in the server’s /tmp folder.
+On the first run your personal hash to access the database is place in the server<EFBFBD>s /tmp folder.
 Take care to make a backup of this file because this folder is cleaned up after a server reboot.
 
 This version is a major release
@@ -44,7 +69,7 @@ xlx db v2.1.4
 
 - "class.reflector.php" improved the flag search
 - "country.csv" added serveral prefixes
-- "flags" added Puerto Ricco and Åland Islands
+- "flags" added Puerto Ricco and <EFBFBD>land Islands
 
 xlx db v2.1.3
 

dashboard2/index.php

@@ -1,4 +1,5 @@
 <?php
+session_start();
 
 /*
  *  This dashboard is being developed by the DVBrazil Team as a courtesy to
@@ -9,12 +10,12 @@
 if (file_exists("./pgs/functions.php")) {
     require_once("./pgs/functions.php");
 } else {
-    die("functions.php does not exist.");
+    die("Required file not found.");
 }
 if (file_exists("./pgs/config.inc.php")) {
     require_once("./pgs/config.inc.php");
 } else {
-    die("config.inc.php does not exist.");
+    die("Required file not found.");
 }
 
 if (!class_exists('ParseXML')) require_once("./pgs/class.parsexml.php");
@@ -44,7 +45,7 @@ if ($CallingHome['Active']) {
             @fwrite($Ressource, "\n" . '$Hash     = "' . $Hash . '";');
             @fwrite($Ressource, "\n\n" . '?>');
             @fclose($Ressource);
-            @exec("chmod 777 " . $CallingHome['HashFile']);
+            @exec("chmod 600 " . $CallingHome['HashFile']);
             $CallHomeNow = true;
         }
     } else {
@@ -79,12 +80,11 @@ if ($CallingHome['Active']) {
     <meta charset="utf-8">
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <meta name="description" content="<?php echo $PageOptions['MetaDescription']; ?>"/>
-    <meta name="keywords" content="<?php echo $PageOptions['MetaKeywords']; ?>"/>
-    <meta name="author" content="<?php echo $PageOptions['MetaAuthor']; ?>"/>
-    <meta name="revisit" content="<?php echo $PageOptions['MetaRevisit']; ?>"/>
-    <meta name="robots" content="<?php echo $PageOptions['MetaAuthor']; ?>"/>
-
+    <meta name="description" content="<?php echo SafeOutputAttr($PageOptions['MetaDescription']); ?>"/>
+    <meta name="keywords" content="<?php echo SafeOutputAttr($PageOptions['MetaKeywords']); ?>"/>
+    <meta name="author" content="<?php echo SafeOutputAttr($PageOptions['MetaAuthor']); ?>"/>
+    <meta name="revisit" content="<?php echo SafeOutputAttr($PageOptions['MetaRevisit']); ?>"/>
+    <meta name="robots" content="<?php echo SafeOutputAttr($PageOptions['MetaAuthor']); ?>"/>
     <meta http-equiv="content-type" content="text/html; charset=utf-8"/>
     <title><?php echo $Reflector->GetReflectorName(); ?> Reflector Dashboard</title>
     <link rel="icon" href="./favicon.ico" type="image/vnd.microsoft.icon">
@@ -113,8 +113,8 @@ if ($CallingHome['Active']) {
         if (($_SERVER['REQUEST_METHOD'] === 'POST') || isset($_GET['do'])) {
           echo '
          document.location.href = "./index.php';
-          if (isset($_GET['show'])) {
-            echo '?show=' . $_GET['show'];
+          if (isset($_GET['show']) && $_GET['show'] !== '') {
+            echo '?show=' . SafeOutput($_GET['show']);
           }
           echo '";';
         } else {
@@ -194,6 +194,15 @@ if ($CallingHome['Active']) {
                 }
             }
 
+            // Whitelist allowed values
+            if (!isset($_GET['show'])) {
+                $_GET['show'] = '';
+            }
+            $allowed_shows = ['users', 'repeaters', 'liveircddb', 'peers', 'reflectors', ''];
+            if (!in_array($_GET['show'], $allowed_shows, true)) {
+                $_GET['show'] = '';
+            }
+
             switch ($_GET['show']) {
                 case 'users'      :
                     require_once("./pgs/users.php");
@@ -222,7 +231,7 @@ if ($CallingHome['Active']) {
 
 <footer class="footer">
     <div class="container">
-        <p><a href="mailto:<?php echo $PageOptions['ContactEmail']; ?>"><?php echo $PageOptions['ContactEmail']; ?></a>
+        <p><a href="mailto:<?php echo SafeOutputAttr($PageOptions['ContactEmail']); ?>"><?php echo SafeOutput($PageOptions['ContactEmail']); ?></a>
         </p>
     </div>
 </footer>

dashboard2/pgs/class.reflector.php

@@ -419,6 +419,10 @@ class xReflector {
    }
       
    public function CallHome() {
+      // Validate URL before making request
+      if (!filter_var($this->CallingHomeServerURL, FILTER_VALIDATE_URL)) {
+         return false;
+      }
       $xml = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <query>CallingHome</query>'.$this->ReflectorXML.$this->InterlinkXML;
       $p = @stream_context_create(array('http' => array('header'  => "Content-type: application/x-www-form-urlencoded\r\n",

dashboard2/pgs/config.inc.php

@@ -16,7 +16,7 @@ $PageOptions = array();
 
 $PageOptions['ContactEmail']                         = 'your_email';		    // Support E-Mail address
 
-$PageOptions['DashboardVersion']                     = '2.3.7';       			// Dashboard Version
+$PageOptions['DashboardVersion']                     = '2.3.8';       			// Dashboard Version
 
 $PageOptions['PageRefreshActive']                    = true;          			// Activate automatic refresh
 $PageOptions['PageRefreshDelay']                     = '10000';       			// Page refresh time in miliseconds

dashboard2/pgs/functions.php

@@ -59,4 +59,30 @@ function CreateCode ($laenge) {
 	return $out;  
 }
 
+function SafeOutput($string, $encoding = 'UTF-8') {
+    return htmlspecialchars($string, ENT_QUOTES | ENT_HTML5, $encoding);
+}
+
+function SafeOutputAttr($string, $encoding = 'UTF-8') {
+    // Extra safe for attributes
+    return htmlspecialchars($string, ENT_QUOTES | ENT_HTML5, $encoding);
+}
+
+function GenerateCSRFToken() {
+    if (!isset($_SESSION)) {
+        session_start();
+    }
+    if (!isset($_SESSION['csrf_token'])) {
+        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+    }
+    return $_SESSION['csrf_token'];
+}
+
+function ValidateCSRFToken($token) {
+    if (!isset($_SESSION)) {
+        session_start();
+    }
+    return isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token);
+}
+
 ?>

dashboard2/pgs/peers.php

@@ -44,8 +44,8 @@ for ($i=0;$i<$Reflector->PeerCount();$i++) {
   <tr class="table-center">
    <td>'.($i+1).'</td>';
 
-   $Name = $Reflector->Peers[$i]->GetCallSign();
-   $URL = '';
+    $Name = $Reflector->Peers[$i]->GetCallSign();
+    $URL = '';
 
     for ($j=1;$j<count($Reflectors);$j++) {
         if ($Name === $XML->GetElement($Reflectors[$j], "name")) {
@@ -53,15 +53,15 @@ for ($i=0;$i<$Reflector->PeerCount();$i++) {
         }
     }
     if ($Result && (trim($URL) != "")) {
-        echo '<td><a href="'.$URL.'" target="_blank" class="listinglink" title="Visit the Dashboard of&nbsp;'.$Name.'" style="text-decoration:none;color:#000000;">'.$Name.'</a></td>';
+        echo '<td><a href="' . SafeOutputAttr($URL) . '" target="_blank" class="listinglink" title="Visit the Dashboard of&nbsp;' . SafeOutputAttr($Name) . '" style="text-decoration:none;color:#000000;">' . SafeOutput($Name) . '</a></td>';
     } else {
-        echo '<td>'.$Name.'</td>';
+        echo '<td>' . SafeOutput($Name) . '</td>';
     }
     echo '
    <td>'.date("d.m.Y H:i", $Reflector->Peers[$i]->GetLastHeardTime()).'</td>
    <td>'.FormatSeconds(time()-$Reflector->Peers[$i]->GetConnectTime()).' s</td>
-   <td>'.$Reflector->Peers[$i]->GetProtocol().'</td>
-   <td>'.$Reflector->Peers[$i]->GetLinkedModule().'</td>';
+   <td>'.SafeOutput($Reflector->Peers[$i]->GetProtocol()).'</td>
+   <td>'.SafeOutput($Reflector->Peers[$i]->GetLinkedModule()).'</td>';
    if ($PageOptions['PeerPage']['IPModus'] != 'HideIP') {
       echo '<td>';
       $Bytes = explode(".", $Reflector->Peers[$i]->GetIP());
@@ -70,7 +70,7 @@ for ($i=0;$i<$Reflector->PeerCount();$i++) {
             case 'ShowLast1ByteOfIP'      : echo $PageOptions['PeerPage']['MasqueradeCharacter'].'.'.$PageOptions['PeerPage']['MasqueradeCharacter'].'.'.$PageOptions['PeerPage']['MasqueradeCharacter'].'.'.$Bytes[3]; break;
             case 'ShowLast2ByteOfIP'      : echo $PageOptions['PeerPage']['MasqueradeCharacter'].'.'.$PageOptions['PeerPage']['MasqueradeCharacter'].'.'.$Bytes[2].'.'.$Bytes[3]; break;
             case 'ShowLast3ByteOfIP'      : echo $PageOptions['PeerPage']['MasqueradeCharacter'].'.'.$Bytes[1].'.'.$Bytes[2].'.'.$Bytes[3]; break;
-            default                       : echo '<a href="http://'.$Reflector->Peers[$i]->GetIP().'" target="_blank" style="text-decoration:none;color:#000000;">'.$Reflector->Peers[$i]->GetIP().'</a>';
+            default                       : echo '<a href="http://'.SafeOutput($Reflector->Peers[$i]->GetIP()).'" target="_blank" style="text-decoration:none;color:#000000;">'.SafeOutput($Reflector->Peers[$i]->GetIP()).'</a>';
          }
       }
       echo '</td>';

dashboard2/pgs/reflectors.php

@@ -38,10 +38,10 @@ for ($i=0;$i<count($Reflectors);$i++) {
    echo '
  <tr class="table-center">
    <td>'.($i+1).'</td>
-   <td><a href="'.$DASHBOARDURL.'" target="_blank" class="listinglink" title="Visit the Dashboard of&nbsp;'.$NAME.'">'.$NAME.'</a></td>
-   <td>'.$COUNTRY.'</td>
+   <td><a href="' . SafeOutputAttr($DASHBOARDURL) . '" target="_blank" class="listinglink" title="Visit the Dashboard of&nbsp;' . SafeOutputAttr($NAME) . '">' . SafeOutput($NAME) . '</a></td>
+   <td>' . SafeOutput($COUNTRY) . '</td>
    <td><img src="./img/'; if ($LASTCONTACT<(time()-1800)) { echo 'down'; } ELSE { echo 'up'; } echo '.png" class="table-status" alt=""></td>
-   <td>'.$COMMENT.'</td>
+   <td>' . SafeOutput($COMMENT) . '</td>
  </tr>';
 }
 

dashboard2/pgs/repeaters.php

@@ -30,10 +30,10 @@ for ($i=0;$i<$Reflector->NodeCount();$i++) {
       echo '<a href="#" class="tip"><img src="./img/flags/'.$Flag.'.png" class="table-flag" alt="'.$Name.'"><span>'.$Name.'</span></a>';
    }
    echo '</td>
-   <td><a href="http://www.aprs.fi/'.$Reflector->Nodes[$i]->GetCallSign();
-   if ($Reflector->Nodes[$i]->GetSuffix() != "") echo '-'.$Reflector->Nodes[$i]->GetSuffix();
-   echo '" class="pl" target="_blank">'.$Reflector->Nodes[$i]->GetCallSign();
-   if ($Reflector->Nodes[$i]->GetSuffix() != "") { echo '-'.$Reflector->Nodes[$i]->GetSuffix(); } 
+   <td><a href="http://www.aprs.fi/'.SafeOutput($Reflector->Nodes[$i]->GetCallSign());
+   if ($Reflector->Nodes[$i]->GetSuffix() != "") echo '-'.SafeOutput($Reflector->Nodes[$i]->GetSuffix());
+   echo '" class="pl" target="_blank">'.SafeOutput($Reflector->Nodes[$i]->GetCallSign());
+   if ($Reflector->Nodes[$i]->GetSuffix() != "") { echo '-'.SafeOutput($Reflector->Nodes[$i]->GetSuffix()); } 
    echo '</a></td>
    <td>';
    if (($Reflector->Nodes[$i]->GetPrefix() == 'REF') || ($Reflector->Nodes[$i]->GetPrefix() == 'XRF')) {
@@ -55,8 +55,8 @@ for ($i=0;$i<$Reflector->NodeCount();$i++) {
    echo '</td>
    <td>'.date("d.m.Y H:i", $Reflector->Nodes[$i]->GetLastHeardTime()).'</td>
    <td>'.FormatSeconds(time()-$Reflector->Nodes[$i]->GetConnectTime()).' s</td>
-   <td>'.$Reflector->Nodes[$i]->GetProtocol().'</td>
-   <td>'.$Reflector->Nodes[$i]->GetLinkedModule().'</td>';
+   <td>'.SafeOutput($Reflector->Nodes[$i]->GetProtocol()).'</td>
+   <td>'.SafeOutput($Reflector->Nodes[$i]->GetLinkedModule()).'</td>';
    if ($PageOptions['RepeatersPage']['IPModus'] != 'HideIP') {
       echo '
    <td>';

dashboard2/pgs/users.php

@@ -9,6 +9,11 @@ if (!isset($_SESSION['FilterModule'])) {
 }
 
 if (isset($_POST['do'])) {
+    // Validate CSRF token
+    if (!isset($_POST['csrf_token']) || !ValidateCSRFToken($_POST['csrf_token'])) {
+        die('CSRF token validation failed');
+    }
+
     if ($_POST['do'] == 'SetFilter') {
 
         if (isset($_POST['txtSetCallsignFilter'])) {
@@ -17,12 +22,17 @@ if (isset($_POST['do'])) {
                 $_SESSION['FilterCallSign'] = null;
             }
             else {
-                $_SESSION['FilterCallSign'] = $_POST['txtSetCallsignFilter'];
-                if (strpos($_SESSION['FilterCallSign'], "*") === false) {
-                    $_SESSION['FilterCallSign'] = "*".$_SESSION['FilterCallSign']."*";
+                // Validate callsign format (alphanumeric, dash, asterisk only)
+                if (preg_match('/^[A-Z0-9\-\*]+$/i', $_POST['txtSetCallsignFilter'])) {
+                    $_SESSION['FilterCallSign'] = $_POST['txtSetCallsignFilter'];
+                    if (strpos($_SESSION['FilterCallSign'], "*") === false) {
+                        $_SESSION['FilterCallSign'] = "*".$_SESSION['FilterCallSign']."*";
+                    }
+                } else {
+                    // Invalid format, reject it
+                    $_SESSION['FilterCallSign'] = null;
                 }
             }
-
         }
 
         if (isset($_POST['txtSetModuleFilter'])) {
@@ -31,9 +41,14 @@ if (isset($_POST['do'])) {
                 $_SESSION['FilterModule'] = null;
             }
             else {
-                $_SESSION['FilterModule'] = $_POST['txtSetModuleFilter'];
+                // Validate module is single letter A-Z
+                if (preg_match('/^[A-Z]$/i', $_POST['txtSetModuleFilter'])) {
+                    $_SESSION['FilterModule'] = strtoupper($_POST['txtSetModuleFilter']);
+                } else {
+                    // Invalid format, reject it
+                    $_SESSION['FilterModule'] = null;
+                }
             }
-
         }
     }
 }
@@ -60,7 +75,8 @@ if ($PageOptions['UserPage']['ShowFilter']) {
             <td align="left">
                <form name="frmFilterCallSign" method="post" action="./index.php">
                   <input type="hidden" name="do" value="SetFilter" />
-                  <input type="text" class="FilterField" value="'.$_SESSION['FilterCallSign'].'" name="txtSetCallsignFilter" placeholder="Callsign" onfocus="SuspendPageRefresh();" onblur="setTimeout(ReloadPage, '.$PageOptions['PageRefreshDelay'].');" />
+                  <input type="hidden" name="csrf_token" value="' . GenerateCSRFToken() . '" />
+                  <input type="text" class="FilterField" value="'.SafeOutputAttr($_SESSION['FilterCallSign']).'" name="txtSetCallsignFilter" placeholder="Callsign" onfocus="SuspendPageRefresh();" onblur="setTimeout(ReloadPage, '.$PageOptions['PageRefreshDelay'].');" />
                   <input type="submit" value="Apply" class="FilterSubmit" />
                </form>
             </td>';
@@ -72,7 +88,8 @@ if ($PageOptions['UserPage']['ShowFilter']) {
             <td align="right" style="padding-right:3px;">
                <form name="frmFilterModule" method="post" action="./index.php">
                   <input type="hidden" name="do" value="SetFilter" />
-                  <input type="text" class="FilterField" value="'.$_SESSION['FilterModule'].'" name="txtSetModuleFilter" placeholder="Module" onfocus="SuspendPageRefresh();" onblur="setTimeout(ReloadPage, '.$PageOptions['PageRefreshDelay'].');" />
+                  <input type="hidden" name="csrf_token" value="' . GenerateCSRFToken() . '" />
+                  <input type="text" class="FilterField" value="'.SafeOutputAttr($_SESSION['FilterModule']).'" name="txtSetModuleFilter" placeholder="Module" onfocus="SuspendPageRefresh();" onblur="setTimeout(ReloadPage, '.$PageOptions['PageRefreshDelay'].');" />
                   <input type="submit" value="Apply" class="FilterSubmit" />
                </form>
             </td>
@@ -133,16 +150,16 @@ for ($i=0;$i<$Reflector->StationCount();$i++) {
             echo '<a href="#" class="tip"><img src="./img/flags/' . $Flag . '.png" class="table-flag" alt="' . $Name . '"><span>' . $Name . '</span></a>';
         }
         echo '</td>
-   <td><a href="https://www.qrz.com/db/' . $Reflector->Stations[$i]->GetCallsignOnly() . '" class="pl" target="_blank">' . $Reflector->Stations[$i]->GetCallsignOnly() . '</a></td>
-   <td>' . $Reflector->Stations[$i]->GetSuffix() . '</td>
-   <td><a href="http://www.aprs.fi/' . $Reflector->Stations[$i]->GetCallsignOnly() . '" class="pl" target="_blank"><img src="./img/sat.png" alt=""></a></td>
-   <td>' . $Reflector->Stations[$i]->GetVia();
+   <td><a href="https://www.qrz.com/db/' . SafeOutput($Reflector->Stations[$i]->GetCallsignOnly()) . '" class="pl" target="_blank">' . SafeOutput($Reflector->Stations[$i]->GetCallsignOnly()) . '</a></td>
+   <td>' . SafeOutput($Reflector->Stations[$i]->GetSuffix()) . '</td>
+   <td><a href="http://www.aprs.fi/' . SafeOutput($Reflector->Stations[$i]->GetCallsignOnly()) . '" class="pl" target="_blank"><img src="./img/sat.png" alt=""></a></td>
+   <td>' . SafeOutput($Reflector->Stations[$i]->GetVia());
         if ($Reflector->Stations[$i]->GetPeer() != $Reflector->GetReflectorName()) {
-            echo ' / ' . $Reflector->Stations[$i]->GetPeer();
+            echo ' / ' . SafeOutput($Reflector->Stations[$i]->GetPeer());
         }
         echo '</td>
    <td>' . @date("d.m.Y H:i", $Reflector->Stations[$i]->GetLastHeardTime()) . '</td>
-   <td>' . $Reflector->Stations[$i]->GetModule() . '</td>
+   <td>' . SafeOutput($Reflector->Stations[$i]->GetModule()) . '</td>
  </tr>';
     }
     if ($i == $PageOptions['LastHeardPage']['LimitTo']) {
@@ -192,7 +209,7 @@ for ($i=0;$i<count($Modules);$i++) {
        $Displayname = $Reflector->GetCallsignAndSuffixByID($Users[$j]);
       echo '
             <tr>
-               <td><a href="http://www.aprs.fi/'.$Displayname.'" class="pl" target="_blank">'.$Displayname.'</a> </td>
+               <td><a href="http://www.aprs.fi/' . SafeOutput($Displayname) . '" class="pl" target="_blank">' . SafeOutput($Displayname) . '</a> </td>
             </tr>';
       $UserCheckedArray[] = $Users[$j];
    }

scripts/xlxd

@@ -19,7 +19,6 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin
 # change below settings according to your system
 NAME="xlxd"
 DAEMON="/xlxd/xlxd"
-ARGUMENTS="XLX999 192.168.1.240 127.0.0.1"
 PIDFILE="/var/log/xlxd.pid"
 USER=root
 GROUP=root
@@ -31,7 +30,7 @@ start () {
 # start daemon
 
 	echo -n "Starting $NAME: "
-	start-stop-daemon --start --exec $DAEMON --chuid $USER:$GROUP --background -- $ARGUMENTS
+	start-stop-daemon --start --exec $DAEMON --chuid $USER:$GROUP --background
 	RETVAL=$?
 	echo
         sleep 4

src/cconfig.cpp

@@ -0,0 +1,104 @@
+//
+//  cconfig.cpp
+//  xlxd
+//
+//  Created by Alessio Caiazza (IU5BON) on 22/07/2022.
+//  Copyright © 2022 Alessio Caiazza (IU5BON). All rights reserved.
+//
+// ----------------------------------------------------------------------------
+//    This file is part of xlxd.
+//
+//    xlxd is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU General Public License as published by
+//    the Free Software Foundation, either version 3 of the License, or
+//    (at your option) any later version.
+//
+//    xlxd is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU General Public License for more details.
+//
+//    You should have received a copy of the GNU General Public License
+//    along with Foobar.  If not, see <http://www.gnu.org/licenses/>.
+// ----------------------------------------------------------------------------
+
+#include "main.h"
+#include "cconfig.h"
+#include "ccallsign.h"
+#include "cip.h"
+#include <string.h>
+
+
+CConfig::CConfig() :
+    m_Callsign("N0CALL"),
+    m_ListenIp(CIp("0.0.0.0")),
+    m_TranscoderIp(CIp("127.0.0.1"))
+{
+    ReadOptions();
+}
+
+
+void CConfig::DumpConfig()
+{
+    std::cout << "Configuration options" << std::endl;
+    std::cout << "callsign " << GetCallsign() << std::endl;
+    std::cout << "listen " << GetListenIp() << std::endl;
+    std::cout << "transcoder " << GetTranscoderIp() << std::endl;
+    std::cout << std::endl;
+}
+
+////////////////////////////////////////////////////////////////////////////////////////
+// option helpers
+
+char *CConfig::TrimWhiteSpaces(char *str)
+{
+    char *end;
+    while ((*str == ' ') || (*str == '\t')) str++;
+    if (*str == 0)
+        return str;
+    end = str + strlen(str) - 1;
+    while ((end > str) && ((*end == ' ') || (*end == '\t') || (*end == '\r'))) end --;
+    *(end + 1) = 0;
+    return str;
+}
+
+void CConfig::ReadOptions(void)
+{
+    char sz[256];
+
+    std::ifstream file(CONFIG_PATH);
+    if (file.is_open())
+    {
+        while (file.getline(sz, sizeof(sz)).good())
+        {
+            char *szt = TrimWhiteSpaces(sz);
+            char *szval;
+
+            if ((::strlen(szt) > 0) && szt[0] != '#')
+            {
+                if ((szt = ::strtok(szt, " ,\t")) != NULL)
+                {
+                    if ((szval = ::strtok(NULL, " ,\t")) != NULL)
+                    {
+                        if (::strncmp(szt, "callsign", 8) == 0)
+                        {
+                            m_Callsign = CCallsign(szval);
+                        }
+                        else if (strncmp(szt, "listen", 5) == 0)
+                        {
+                            m_ListenIp = CIp(szval);
+                        }
+                        else if (strncmp(szt, "transcoder", 10) == 0)
+                        {
+                            m_TranscoderIp = CIp(szval);
+                        }
+                        else
+                        {
+                            // unknown option - ignore
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

src/cconfig.h

@@ -0,0 +1,65 @@
+//
+//  cconfig.h
+//  xlxd
+//
+//  Created by Alessio Caiazza (IU5BON) on 22/07/2022.
+//  Copyright © 2022 Alessio Caiazza (IU5BON). All rights reserved.
+//
+// ----------------------------------------------------------------------------
+//    This file is part of xlxd.
+//
+//    xlxd is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU General Public License as published by
+//    the Free Software Foundation, either version 3 of the License, or
+//    (at your option) any later version.
+//
+//    xlxd is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU General Public License for more details.
+//
+//    You should have received a copy of the GNU General Public License
+//    along with Foobar.  If not, see <http://www.gnu.org/licenses/>.
+// ----------------------------------------------------------------------------
+
+#ifndef cconfig_h
+#define cconfig_h
+
+#include <string>
+#include "cip.h"
+#include "ccallsign.h"
+
+////////////////////////////////////////////////////////////////////////////////////////
+// class
+
+class CConfig
+{
+public:
+    // constructor
+    CConfig();
+
+    void DumpConfig();
+
+    // getters
+    const CCallsign &GetCallsign(void) const        { return m_Callsign; }
+    const CIp &GetListenIp(void) const              { return m_ListenIp; }
+    const CIp &GetTranscoderIp(void) const          { return m_TranscoderIp; }
+
+    // setters for bacward compatible CLI parameters
+    void SetCallsign(const CCallsign &callsign)     { m_Callsign = callsign; }
+    void SetListenIp(const CIp &ip)                 { m_ListenIp = ip; }
+    void SetTranscoderIp(const CIp &ip)             { m_TranscoderIp = ip; }
+
+protected:
+    // config
+    void ReadOptions(void);
+    char* TrimWhiteSpaces(char *str);
+
+protected:
+    CCallsign       m_Callsign;
+    CIp             m_ListenIp;
+    CIp             m_TranscoderIp;
+};
+
+////////////////////////////////////////////////////////////////////////////////////////
+#endif /* cconfig_h */

src/main.cpp

@@ -24,6 +24,7 @@
 
 #include "main.h"
 #include "creflector.h"
+#include "cconfig.h"
 
 #include "syslog.h"
 #include <sys/stat.h>
@@ -86,21 +87,34 @@ int main(int argc, const char * argv[])
     
 #endif
 
+    CConfig conf = CConfig();
+
     // check arguments
-    if ( argc != 4 )
+    if ( argc == 4 )
+    {
+        conf.SetCallsign(CCallsign(argv[1]));
+        conf.SetListenIp(CIp(argv[2]));
+        conf.SetTranscoderIp(CIp(argv[3]));
+    }
+    else if ( argc != 1 )
     {
         std::cout << "Usage: xlxd callsign xlxdip ambedip" << std::endl;
         std::cout << "example: xlxd XLX999 192.168.178.212 127.0.0.1" << std::endl;
+
+        std::cout << "Startup parameters can also be defined in " << CONFIG_PATH << std::endl;
+
         return 1;
     }
 
     // splash
     std::cout << "Starting xlxd " << VERSION_MAJOR << "." << VERSION_MINOR << "." << VERSION_REVISION << std::endl << std::endl;
 
+    conf.DumpConfig();
+
     // initialize reflector
-    g_Reflector.SetCallsign(argv[1]);
-    g_Reflector.SetListenIp(CIp(argv[2]));
-    g_Reflector.SetTranscoderIp(CIp(CIp(argv[3])));
+    g_Reflector.SetCallsign(conf.GetCallsign());
+    g_Reflector.SetListenIp(conf.GetListenIp());
+    g_Reflector.SetTranscoderIp(conf.GetTranscoderIp());
   
     // and let it run
     if ( !g_Reflector.Start() )

src/main.h

@@ -176,6 +176,9 @@
 
 // system paths -------------------------------------------------
 
+#ifndef CONFIG_PATH
+#define CONFIG_PATH                     "/xlxd/xlxd.config"
+#endif
 #define XML_PATH                        "/var/log/xlxd.xml"
 #define WHITELIST_PATH                  "/xlxd/xlxd.whitelist"
 #define BLACKLIST_PATH                  "/xlxd/xlxd.blacklist"