- first attempt for connection loading and starting via "stroke"
[strongswan.git] / Source / charon / config / stroke_configuration.c
1 /**
2 * @file stroke_configuration.c
3 *
4 * @brief Implementation of stroke_configuration_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include <stdlib.h>
24 #include <sys/types.h>
25 #include <sys/stat.h>
26 #include <sys/socket.h>
27 #include <sys/un.h>
28 #include <sys/fcntl.h>
29 #include <unistd.h>
30 #include <errno.h>
31 #include <pthread.h>
32
33 #include "stroke_configuration.h"
34
35 #include <types.h>
36 #include <daemon.h>
37 #include <utils/allocator.h>
38 #include <queues/jobs/initiate_ike_sa_job.h>
39
40 /**
41 * First retransmit timeout in milliseconds.
42 *
43 * Timeout value is increasing in each retransmit round.
44 */
45 #define RETRANSMIT_TIMEOUT 3000
46
47 /**
48 * Timeout in milliseconds after that a half open IKE_SA gets deleted.
49 */
50 #define HALF_OPEN_IKE_SA_TIMEOUT 30000
51
52 /**
53 * Max retransmit count.
54 * 0 for infinite. The max time a half open IKE_SA is alive is set by
55 * RETRANSMIT_TIMEOUT.
56 */
57 #define MAX_RETRANSMIT_COUNT 0
58
59
60 struct sockaddr_un socket_addr = { AF_UNIX, "/var/run/charon.ctl"};
61
62
63 typedef struct preshared_secret_entry_t preshared_secret_entry_t;
64
65 /**
66 * A preshared secret entry combines an identifier and a
67 * preshared secret.
68 */
69 struct preshared_secret_entry_t {
70
71 /**
72 * Identification.
73 */
74 identification_t *identification;
75
76 /**
77 * Preshared secret as chunk_t. The NULL termination is not included.
78 */
79 chunk_t preshared_secret;
80 };
81
82
83 typedef struct rsa_private_key_entry_t rsa_private_key_entry_t;
84
85 /**
86 * Entry for a rsa private key.
87 */
88 struct rsa_private_key_entry_t {
89
90 /**
91 * Identification.
92 */
93 identification_t *identification;
94
95 /**
96 * Private key.
97 */
98 rsa_private_key_t* private_key;
99 };
100
101 typedef struct rsa_public_key_entry_t rsa_public_key_entry_t;
102
103 /**
104 * Entry for a rsa private key.
105 */
106 struct rsa_public_key_entry_t {
107
108 /**
109 * Identification.
110 */
111 identification_t *identification;
112
113 /**
114 * Private key.
115 */
116 rsa_public_key_t* public_key;
117 };
118
119 typedef struct configuration_entry_t configuration_entry_t;
120
121 /**
122 * A configuration entry combines a configuration name with a init and sa
123 * configuration represented as init_config_t and sa_config_t objects.
124 *
125 * @b Constructors:
126 * - configuration_entry_create()
127 */
128 struct configuration_entry_t {
129
130 /**
131 * Configuration name.
132 *
133 */
134 char *name;
135
136 /**
137 * Configuration for IKE_SA_INIT exchange.
138 */
139 init_config_t *init_config;
140
141 /**
142 * Configuration for all phases after IKE_SA_INIT exchange.
143 */
144 sa_config_t *sa_config;
145
146 /**
147 * Destroys a configuration_entry_t
148 *
149 * @param this calling object
150 */
151 void (*destroy) (configuration_entry_t *this);
152 };
153
154 /**
155 * Implementation of configuration_entry_t.destroy.
156 */
157 static void configuration_entry_destroy (configuration_entry_t *this)
158 {
159 allocator_free(this->name);
160 allocator_free(this);
161 }
162
163 /**
164 * @brief Creates a configuration_entry_t object.
165 *
166 * @param name name of the configuration entry (gets copied)
167 * @param init_config object of type init_config_t
168 * @param sa_config object of type sa_config_t
169 */
170 static configuration_entry_t * configuration_entry_create(char * name, init_config_t * init_config, sa_config_t * sa_config)
171 {
172 configuration_entry_t *entry = allocator_alloc_thing(configuration_entry_t);
173
174 /* functions */
175 entry->destroy = configuration_entry_destroy;
176
177 /* private data */
178 entry->init_config = init_config;
179 entry->sa_config = sa_config;
180 entry->name = allocator_alloc(strlen(name) + 1);
181 strcpy(entry->name,name);
182 return entry;
183 }
184
185 typedef struct private_stroke_configuration_t private_stroke_configuration_t;
186
187 /**
188 * Private data of an stroke_configuration_t object.
189 */
190 struct private_stroke_configuration_t {
191
192 /**
193 * Public part of stroke_configuration_t object.
194 */
195 stroke_configuration_t public;
196
197 /**
198 * Holding all configurations.
199 */
200 linked_list_t *configurations;
201
202 /**
203 * Holding all managed init_configs.
204 */
205 linked_list_t *init_configs;
206
207 /**
208 * Holding all managed init_configs.
209 */
210 linked_list_t *sa_configs;
211
212 /**
213 * Holding all managed preshared secrets.
214 */
215 linked_list_t *preshared_secrets;
216
217 /**
218 * Holding all managed private secrets.
219 */
220 linked_list_t *rsa_private_keys;
221
222 /**
223 * Holding all managed public secrets.
224 */
225 linked_list_t *rsa_public_keys;
226
227 /**
228 * Assigned logger_t object.
229 */
230 logger_t *logger;
231
232 /**
233 * Max number of requests to be retransmitted.
234 * 0 for infinite.
235 */
236 u_int32_t max_retransmit_count;
237
238 /**
239 * First retransmit timeout in ms.
240 */
241 u_int32_t first_retransmit_timeout;
242
243 /**
244 * Timeout in ms after that time a IKE_SA gets deleted.
245 */
246 u_int32_t half_open_ike_sa_timeout;
247
248 int socket;
249
250 pthread_t assigned_thread;
251
252 /**
253 * Adds a new IKE_SA configuration.
254 *
255 * @param this calling object
256 * @param name name for the configuration
257 * @param init_config init_config_t object
258 * @param sa_config sa_config_t object
259 */
260 void (*add_new_configuration) (private_stroke_configuration_t *this, char *name, init_config_t *init_config, sa_config_t *sa_config);
261
262 /**
263 * Adds a new preshared secret.
264 *
265 * @param this calling object
266 * @param type type of identification
267 * @param id_string identification as string
268 * @param preshared_secret preshared secret as string
269 */
270 void (*add_new_preshared_secret) (private_stroke_configuration_t *this,id_type_t type, char *id_string, char *preshared_secret);
271
272 /**
273 * Adds a new rsa private key.
274 *
275 * @param this calling object
276 * @param type type of identification
277 * @param id_string identification as string
278 * @param key_pos location of key
279 * @param key_len length of key
280 */
281 void (*add_new_rsa_private_key) (private_stroke_configuration_t *this,id_type_t type, char *id_string, u_int8_t *key_pos, size_t key_len);
282
283 /**
284 * Adds a new rsa public key.
285 *
286 * @param this calling object
287 * @param type type of identification
288 * @param id_string identification as string
289 * @param key_pos location of key
290 * @param key_len length of key
291 */
292 void (*add_new_rsa_public_key) (private_stroke_configuration_t *this,id_type_t type, char *id_string, u_int8_t *key_pos, size_t key_len);
293
294 void (*whack_receive) (private_stroke_configuration_t *this);
295 };
296
297 extern u_int8_t public_key_1[];
298 extern u_int8_t private_key_1[];
299 extern u_int8_t public_key_2[];
300 extern u_int8_t private_key_2[];
301
302 static void fix_string(stroke_msg_t *msg, char **string)
303 {
304 /* check for sanity of string pointer and string */
305 if (string < (char**)msg ||
306 string > (char**)msg + sizeof(stroke_msg_t) ||
307 *string < (char*)msg->buffer - (u_int)msg ||
308 *string > (char*)(u_int)msg->length)
309 {
310 *string = "(invalid char* in stroke msg)";
311 }
312 else
313 {
314 *string = (char*)msg + (u_int)*string;
315 }
316 }
317
318 /**
319 * Implementation of private_stroke_configuration_t.listen.
320 */
321 static void whack_receive(private_stroke_configuration_t *this)
322 {
323 stroke_msg_t *msg;
324 u_int16_t msg_length;
325 struct sockaddr_un whackaddr;
326 int whackaddrlen = sizeof(whackaddr);
327 ssize_t n;
328 int whackfd;
329
330 while (1)
331 {
332 whackfd = accept(this->socket, (struct sockaddr *)&whackaddr, &whackaddrlen);
333
334 if (whackfd < 0)
335 {
336 this->logger->log(this->logger, ERROR, "accepting stroke connection failed");
337 continue;
338 }
339
340 /* peek the length */
341 n = recv(whackfd, &msg_length, sizeof(msg_length), MSG_PEEK);
342 if (n != sizeof(msg_length))
343 {
344 this->logger->log(this->logger, ERROR, "reading lenght of stroke message failed");
345 close(whackfd);
346 continue;
347 }
348
349 /* read message */
350 msg = allocator_alloc(msg_length);
351 n = recv(whackfd, msg, msg_length, 0);
352 if (n != msg_length)
353 {
354 this->logger->log(this->logger, ERROR, "reading stroke message failed");
355 close(whackfd);
356 continue;
357 }
358
359 this->logger->log_bytes(this->logger, RAW|LEVEL1, "Whackinput", (void*)msg, msg_length);
360
361 switch (msg->type)
362 {
363 case STR_INITIATE:
364 {
365 initiate_ike_sa_job_t *job;
366 fix_string(msg, &(msg->initiate.name));
367 this->logger->log(this->logger, CONTROL|LEVEL1, "received stroke: initiate \"%s\"", msg->initiate.name);
368 job = initiate_ike_sa_job_create(msg->initiate.name);
369 charon->job_queue->add(charon->job_queue, (job_t*)job);
370 break;
371 }
372 case STR_INSTALL:
373 {
374 fix_string(msg, &(msg->install.name));
375 this->logger->log(this->logger, CONTROL|LEVEL1, "received stroke: install \"%s\"", msg->install.name);
376 break;
377 }
378 case STR_ADD_CONN:
379 {
380 sa_config_t *sa_config;
381 init_config_t *init_config;
382 host_t *me, *other;
383 proposal_t *proposal;
384 traffic_selector_t *ts;
385
386 this->logger->log(this->logger, CONTROL|LEVEL1, "my id is: \"%p\"", msg->add_conn.me.id);
387 this->logger->log(this->logger, CONTROL|LEVEL1, "other id is: \"%p\"", msg->add_conn.other.id);
388 fix_string(msg, &msg->add_conn.name);
389 fix_string(msg, &msg->add_conn.me.id);
390 fix_string(msg, &msg->add_conn.other.id);
391 this->logger->log(this->logger, CONTROL|LEVEL1, "received stroke: add connection \"%s\"", msg->add_conn.name);
392
393 msg->add_conn.me.address.v4.sin_port = htons(500);
394 msg->add_conn.other.address.v4.sin_port = htons(500);
395 me = host_create_from_sockaddr(&msg->add_conn.me.address.saddr);
396 other = host_create_from_sockaddr(&msg->add_conn.other.address.saddr);
397
398 init_config = init_config_create(me, other);
399 proposal = proposal_create(1);
400 proposal->add_algorithm(proposal, IKE, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
401 proposal->add_algorithm(proposal, IKE, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 0);
402 proposal->add_algorithm(proposal, IKE, PSEUDO_RANDOM_FUNCTION, PRF_HMAC_SHA1, 0);
403 proposal->add_algorithm(proposal, IKE, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
404 init_config->add_proposal(init_config, proposal);
405
406 this->logger->log(this->logger, CONTROL|LEVEL1, "my id is: \"%s\"", msg->add_conn.me.id);
407 this->logger->log(this->logger, CONTROL|LEVEL1, "other id is: \"%s\"", msg->add_conn.other.id);
408
409 sa_config = sa_config_create(ID_IPV4_ADDR, msg->add_conn.me.id,
410 ID_IPV4_ADDR, msg->add_conn.other.id,
411 SHARED_KEY_MESSAGE_INTEGRITY_CODE, 30000);
412
413 this->add_new_preshared_secret(this, ID_IPV4_ADDR, "192.168.0.1","verschluesselt");
414 this->add_new_preshared_secret(this, ID_IPV4_ADDR, "192.168.0.2","verschluesselt");
415
416 proposal = proposal_create(1);
417 proposal->add_algorithm(proposal, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
418 proposal->add_algorithm(proposal, ESP, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 0);
419 sa_config->add_proposal(sa_config, proposal);
420
421 me = host_create_from_sockaddr(&msg->add_conn.me.subnet.saddr);
422 ts = traffic_selector_create_from_subnet(me, msg->add_conn.me.subnet_netbits);
423 sa_config->add_my_traffic_selector(sa_config,ts);
424 chunk_t chunk = ts->get_to_address(ts);
425 this->logger->log_chunk(this->logger, CONTROL|LEVEL1, "my toaddr", &chunk);
426 other = host_create_from_sockaddr(&msg->add_conn.other.subnet.saddr);
427 ts = traffic_selector_create_from_subnet(other, msg->add_conn.other.subnet_netbits);
428 sa_config->add_other_traffic_selector(sa_config,ts);
429 chunk = ts->get_to_address(ts);
430 this->logger->log_chunk(this->logger, CONTROL|LEVEL1, "other toaddr", &chunk);
431
432 this->add_new_configuration(this, msg->add_conn.name, init_config, sa_config);
433 this->logger->log(this->logger, CONTROL|LEVEL1, "connection added \"%s\"", msg->add_conn.name);
434
435 break;
436 }
437 case STR_DEL_CONN:
438 default:
439 this->logger->log(this->logger, ERROR, "received invalid stroke");
440 }
441
442 allocator_free(msg);
443 }
444 }
445
446
447 /**
448 * Implementation of stroke_configuration_t.get_init_config_for_host.
449 */
450 static status_t get_init_config_for_host (private_stroke_configuration_t *this, host_t *my_host, host_t *other_host,init_config_t **init_config)
451 {
452 iterator_t *iterator;
453 status_t status = NOT_FOUND;
454
455 iterator = this->configurations->create_iterator(this->configurations,TRUE);
456
457 this->logger->log(this->logger, CONTROL|LEVEL1, "getting config for hosts %s - %s",
458 my_host->get_address(my_host), other_host->get_address(other_host));
459
460 while (iterator->has_next(iterator))
461 {
462 configuration_entry_t *entry;
463 host_t *config_my_host;
464 host_t *config_other_host;
465
466 iterator->current(iterator,(void **) &entry);
467
468 config_my_host = entry->init_config->get_my_host(entry->init_config);
469 config_other_host = entry->init_config->get_other_host(entry->init_config);
470
471 /* first check if ip is equal */
472 if(config_other_host->ip_is_equal(config_other_host,other_host))
473 {
474 this->logger->log(this->logger, CONTROL|LEVEL2, "config entry with remote host %s",
475 config_other_host->get_address(config_other_host));
476 /* could be right one, check my_host for default route*/
477 if (config_my_host->is_default_route(config_my_host))
478 {
479 *init_config = entry->init_config;
480 status = SUCCESS;
481 break;
482 }
483 /* check now if host informations are the same */
484 else if (config_my_host->ip_is_equal(config_my_host,my_host))
485 {
486 *init_config = entry->init_config;
487 status = SUCCESS;
488 break;
489 }
490
491 }
492 /* Then check for wildcard hosts!
493 * TODO
494 * actually its only checked if other host with default route can be found! */
495 else if (config_other_host->is_default_route(config_other_host))
496 {
497 /* could be right one, check my_host for default route*/
498 if (config_my_host->is_default_route(config_my_host))
499 {
500 *init_config = entry->init_config;
501 status = SUCCESS;
502 break;
503 }
504 /* check now if host informations are the same */
505 else if (config_my_host->ip_is_equal(config_my_host,my_host))
506 {
507 *init_config = entry->init_config;
508 status = SUCCESS;
509 break;
510 }
511 }
512 }
513
514 iterator->destroy(iterator);
515
516 return status;
517 }
518
519 /**
520 * Implementation of stroke_configuration_t.get_init_config_for_name.
521 */
522 static status_t get_init_config_for_name (private_stroke_configuration_t *this, char *name, init_config_t **init_config)
523 {
524 iterator_t *iterator;
525 status_t status = NOT_FOUND;
526
527 iterator = this->configurations->create_iterator(this->configurations,TRUE);
528
529 while (iterator->has_next(iterator))
530 {
531 configuration_entry_t *entry;
532 iterator->current(iterator,(void **) &entry);
533
534 if (strcmp(entry->name,name) == 0)
535 {
536
537 /* found configuration */
538 *init_config = entry->init_config;
539 status = SUCCESS;
540 break;
541 }
542 }
543
544 iterator->destroy(iterator);
545
546 return status;
547 }
548
549 /**
550 * Implementation of stroke_configuration_t.get_sa_config_for_name.
551 */
552 static status_t get_sa_config_for_name (private_stroke_configuration_t *this, char *name, sa_config_t **sa_config)
553 {
554 iterator_t *iterator;
555 status_t status = NOT_FOUND;
556
557 iterator = this->configurations->create_iterator(this->configurations,TRUE);
558
559 while (iterator->has_next(iterator))
560 {
561 configuration_entry_t *entry;
562 iterator->current(iterator,(void **) &entry);
563
564 if (strcmp(entry->name,name) == 0)
565 {
566 /* found configuration */
567 *sa_config = entry->sa_config;
568 status = SUCCESS;
569 break;
570 }
571 }
572
573 iterator->destroy(iterator);
574
575 return status;
576 }
577
578 /**
579 * Implementation of stroke_configuration_t.get_sa_config_for_init_config_and_id.
580 */
581 static status_t get_sa_config_for_init_config_and_id (private_stroke_configuration_t *this, init_config_t *init_config, identification_t *other_id, identification_t *my_id,sa_config_t **sa_config)
582 {
583 iterator_t *iterator;
584 status_t status = NOT_FOUND;
585
586 iterator = this->configurations->create_iterator(this->configurations,TRUE);
587
588 while (iterator->has_next(iterator))
589 {
590 configuration_entry_t *entry;
591 iterator->current(iterator,(void **) &entry);
592
593 if (entry->init_config == init_config)
594 {
595 identification_t *config_my_id = entry->sa_config->get_my_id(entry->sa_config);
596 identification_t *config_other_id = entry->sa_config->get_other_id(entry->sa_config);
597
598 /* host informations seem to be the same */
599 if (config_other_id->equals(config_other_id,other_id))
600 {
601 /* other ids seems to match */
602
603 if (my_id == NULL)
604 {
605 /* first matching one is selected */
606
607 /* TODO priorize found entries */
608 *sa_config = entry->sa_config;
609 status = SUCCESS;
610 break;
611 }
612
613 if (config_my_id->equals(config_my_id,my_id))
614 {
615 *sa_config = entry->sa_config;
616 status = SUCCESS;
617 break;
618 }
619
620 }
621 }
622 }
623
624 iterator->destroy(iterator);
625
626 return status;
627 }
628
629 /**
630 * Implementation of private_stroke_configuration_t.add_new_configuration.
631 */
632 static void add_new_configuration (private_stroke_configuration_t *this, char *name, init_config_t *init_config, sa_config_t *sa_config)
633 {
634 iterator_t *iterator;
635 bool found;
636
637 iterator = this->init_configs->create_iterator(this->init_configs,TRUE);
638 found = FALSE;
639 while (iterator->has_next(iterator))
640 {
641 init_config_t *found_init_config;
642 iterator->current(iterator,(void **) &found_init_config);
643 if (init_config == found_init_config)
644 {
645 found = TRUE;
646 break;
647 }
648 }
649 iterator->destroy(iterator);
650 if (!found)
651 {
652 this->init_configs->insert_first(this->init_configs,init_config);
653 }
654
655 iterator = this->sa_configs->create_iterator(this->sa_configs,TRUE);
656 found = FALSE;
657 while (iterator->has_next(iterator))
658 {
659 sa_config_t *found_sa_config;
660 iterator->current(iterator,(void **) &found_sa_config);
661 if (sa_config == found_sa_config)
662 {
663 found = TRUE;
664 break;
665 }
666 }
667 iterator->destroy(iterator);
668 if (!found)
669 {
670 this->sa_configs->insert_first(this->sa_configs,sa_config);
671 }
672
673 this->configurations->insert_last(this->configurations,configuration_entry_create(name,init_config,sa_config));
674 }
675
676 /**
677 * Implementation of private_stroke_configuration_t.add_new_preshared_secret.
678 */
679 static void add_new_preshared_secret (private_stroke_configuration_t *this,id_type_t type, char *id_string, char *preshared_secret)
680 {
681 preshared_secret_entry_t *entry = allocator_alloc_thing(preshared_secret_entry_t);
682
683 entry->identification = identification_create_from_string(type,id_string);
684 entry->preshared_secret.len = strlen(preshared_secret) + 1;
685 entry->preshared_secret.ptr = allocator_alloc(entry->preshared_secret.len);
686 memcpy(entry->preshared_secret.ptr,preshared_secret,entry->preshared_secret.len);
687
688 this->preshared_secrets->insert_last(this->preshared_secrets,entry);
689 }
690
691 /**
692 * Implementation of private_stroke_configuration_t.add_new_preshared_secret.
693 */
694 static void add_new_rsa_public_key (private_stroke_configuration_t *this, id_type_t type, char *id_string, u_int8_t* key_pos, size_t key_len)
695 {
696 chunk_t key;
697 key.ptr = key_pos;
698 key.len = key_len;
699
700 rsa_public_key_entry_t *entry = allocator_alloc_thing(rsa_public_key_entry_t);
701
702 entry->identification = identification_create_from_string(type,id_string);
703 entry->public_key = rsa_public_key_create();
704 entry->public_key->set_key(entry->public_key, key);
705
706 this->rsa_public_keys->insert_last(this->rsa_public_keys, entry);
707 }
708
709 /**
710 * Implementation of private_stroke_configuration_t.add_new_preshared_secret.
711 */
712 static void add_new_rsa_private_key (private_stroke_configuration_t *this, id_type_t type, char *id_string, u_int8_t* key_pos, size_t key_len)
713 {
714 chunk_t key;
715 key.ptr = key_pos;
716 key.len = key_len;
717
718 rsa_private_key_entry_t *entry = allocator_alloc_thing(rsa_private_key_entry_t);
719
720 entry->identification = identification_create_from_string(type,id_string);
721 entry->private_key = rsa_private_key_create();
722 entry->private_key->set_key(entry->private_key, key);
723
724 this->rsa_private_keys->insert_last(this->rsa_private_keys, entry);
725 }
726
727 /**
728 * Implementation of stroke_configuration_t.get_shared_secret.
729 */
730 static status_t get_shared_secret(private_stroke_configuration_t *this, identification_t *identification, chunk_t *preshared_secret)
731 {
732 iterator_t *iterator;
733
734 iterator = this->preshared_secrets->create_iterator(this->preshared_secrets,TRUE);
735 while (iterator->has_next(iterator))
736 {
737 preshared_secret_entry_t *entry;
738 iterator->current(iterator,(void **) &entry);
739 if (entry->identification->equals(entry->identification,identification))
740 {
741 *preshared_secret = entry->preshared_secret;
742 iterator->destroy(iterator);
743 return SUCCESS;
744 }
745 }
746 iterator->destroy(iterator);
747 return NOT_FOUND;
748 }
749
750 /**
751 * Implementation of stroke_configuration_t.get_shared_secret.
752 */
753 static status_t get_rsa_public_key(private_stroke_configuration_t *this, identification_t *identification, rsa_public_key_t **public_key)
754 {
755 iterator_t *iterator;
756
757 iterator = this->rsa_public_keys->create_iterator(this->rsa_public_keys,TRUE);
758 while (iterator->has_next(iterator))
759 {
760 rsa_public_key_entry_t *entry;
761 iterator->current(iterator,(void **) &entry);
762 if (entry->identification->equals(entry->identification,identification))
763 {
764 *public_key = entry->public_key;
765 iterator->destroy(iterator);
766 return SUCCESS;
767 }
768 }
769 iterator->destroy(iterator);
770 return NOT_FOUND;
771 }
772
773 /**
774 * Implementation of stroke_configuration_t.get_shared_secret.
775 */
776 static status_t get_rsa_private_key(private_stroke_configuration_t *this, identification_t *identification, rsa_private_key_t **private_key)
777 {
778 iterator_t *iterator;
779
780 iterator = this->rsa_private_keys->create_iterator(this->rsa_private_keys,TRUE);
781 while (iterator->has_next(iterator))
782 {
783 rsa_private_key_entry_t *entry;
784 iterator->current(iterator,(void **) &entry);
785 if (entry->identification->equals(entry->identification,identification))
786 {
787 *private_key = entry->private_key;
788 iterator->destroy(iterator);
789 return SUCCESS;
790 }
791 }
792 iterator->destroy(iterator);
793 return NOT_FOUND;
794 }
795
796 /**
797 * Implementation of stroke_configuration_t.get_retransmit_timeout.
798 */
799 static status_t get_retransmit_timeout (private_stroke_configuration_t *this, u_int32_t retransmit_count, u_int32_t *timeout)
800 {
801 int new_timeout = this->first_retransmit_timeout, i;
802 if ((retransmit_count > this->max_retransmit_count) && (this->max_retransmit_count != 0))
803 {
804 return FAILED;
805 }
806
807
808 for (i = 0; i < retransmit_count; i++)
809 {
810 new_timeout *= 2;
811 }
812
813 *timeout = new_timeout;
814
815 return SUCCESS;
816 }
817
818 /**
819 * Implementation of stroke_configuration_t.get_half_open_ike_sa_timeout.
820 */
821 static u_int32_t get_half_open_ike_sa_timeout (private_stroke_configuration_t *this)
822 {
823 return this->half_open_ike_sa_timeout;
824 }
825
826 /**
827 * Implementation of stroke_configuration_t.destroy.
828 */
829 static void destroy(private_stroke_configuration_t *this)
830 {
831 this->logger->log(this->logger,CONTROL | LEVEL1, "Going to destroy configuration backend ");
832
833 this->logger->log(this->logger,CONTROL | LEVEL2, "Destroy configuration entries");
834 while (this->configurations->get_count(this->configurations) > 0)
835 {
836 configuration_entry_t *entry;
837 this->configurations->remove_first(this->configurations,(void **) &entry);
838 entry->destroy(entry);
839 }
840 this->configurations->destroy(this->configurations);
841
842 this->logger->log(this->logger,CONTROL | LEVEL2, "Destroy sa_config_t objects");
843 while (this->sa_configs->get_count(this->sa_configs) > 0)
844 {
845 sa_config_t *sa_config;
846 this->sa_configs->remove_first(this->sa_configs,(void **) &sa_config);
847 sa_config->destroy(sa_config);
848 }
849
850 this->sa_configs->destroy(this->sa_configs);
851
852 this->logger->log(this->logger,CONTROL | LEVEL2, "Destroy init_config_t objects");
853 while (this->init_configs->get_count(this->init_configs) > 0)
854 {
855 init_config_t *init_config;
856 this->init_configs->remove_first(this->init_configs,(void **) &init_config);
857 init_config->destroy(init_config);
858 }
859 this->init_configs->destroy(this->init_configs);
860
861 while (this->preshared_secrets->get_count(this->preshared_secrets) > 0)
862 {
863 preshared_secret_entry_t *entry;
864 this->preshared_secrets->remove_first(this->preshared_secrets,(void **) &entry);
865 entry->identification->destroy(entry->identification);
866 allocator_free_chunk(&(entry->preshared_secret));
867 allocator_free(entry);
868 }
869 this->preshared_secrets->destroy(this->preshared_secrets);
870
871 this->logger->log(this->logger,CONTROL | LEVEL2, "Destroy rsa private keys");
872 while (this->rsa_private_keys->get_count(this->rsa_private_keys) > 0)
873 {
874 rsa_private_key_entry_t *entry;
875 this->rsa_private_keys->remove_first(this->rsa_private_keys,(void **) &entry);
876 entry->identification->destroy(entry->identification);
877 entry->private_key->destroy(entry->private_key);
878 allocator_free(entry);
879 }
880 this->rsa_private_keys->destroy(this->rsa_private_keys);
881
882 this->logger->log(this->logger,CONTROL | LEVEL2, "Destroy rsa public keys");
883 while (this->rsa_public_keys->get_count(this->rsa_public_keys) > 0)
884 {
885 rsa_public_key_entry_t *entry;
886 this->rsa_public_keys->remove_first(this->rsa_public_keys,(void **) &entry);
887 entry->identification->destroy(entry->identification);
888 entry->public_key->destroy(entry->public_key);
889 allocator_free(entry);
890 }
891 this->rsa_public_keys->destroy(this->rsa_public_keys);
892
893 this->logger->log(this->logger,CONTROL | LEVEL2, "Destroy assigned logger");
894 charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
895 close(this->socket);
896 unlink(socket_addr.sun_path);
897 allocator_free(this);
898 }
899
900 /*
901 * Described in header-file
902 */
903 stroke_configuration_t *stroke_configuration_create()
904 {
905 private_stroke_configuration_t *this = allocator_alloc_thing(private_stroke_configuration_t);
906 mode_t old;
907 bool on = TRUE;
908
909 /* public functions */
910 this->public.configuration_interface.destroy = (void(*)(configuration_t*))destroy;
911 this->public.configuration_interface.get_init_config_for_name = (status_t (*) (configuration_t *, char *, init_config_t **)) get_init_config_for_name;
912 this->public.configuration_interface.get_init_config_for_host = (status_t (*) (configuration_t *, host_t *, host_t *,init_config_t **)) get_init_config_for_host;
913 this->public.configuration_interface.get_sa_config_for_name =(status_t (*) (configuration_t *, char *, sa_config_t **)) get_sa_config_for_name;
914 this->public.configuration_interface.get_sa_config_for_init_config_and_id =(status_t (*) (configuration_t *, init_config_t *, identification_t *, identification_t *,sa_config_t **)) get_sa_config_for_init_config_and_id;
915 this->public.configuration_interface.get_retransmit_timeout = (status_t (*) (configuration_t *, u_int32_t retransmit_count, u_int32_t *timeout))get_retransmit_timeout;
916 this->public.configuration_interface.get_half_open_ike_sa_timeout = (u_int32_t (*) (configuration_t *)) get_half_open_ike_sa_timeout;
917 this->public.configuration_interface.get_shared_secret = (status_t (*) (configuration_t *, identification_t *, chunk_t *))get_shared_secret;
918 this->public.configuration_interface.get_rsa_private_key = (status_t (*) (configuration_t *, identification_t *, rsa_private_key_t**))get_rsa_private_key;
919 this->public.configuration_interface.get_rsa_public_key = (status_t (*) (configuration_t *, identification_t *, rsa_public_key_t**))get_rsa_public_key;
920
921 /* private functions */
922 this->add_new_configuration = add_new_configuration;
923 this->add_new_preshared_secret = add_new_preshared_secret;
924 this->add_new_rsa_public_key = add_new_rsa_public_key;
925 this->add_new_rsa_private_key = add_new_rsa_private_key;
926 this->whack_receive = whack_receive;
927
928 this->logger = charon->logger_manager->create_logger(charon->logger_manager,CONFIG,NULL);
929
930 /* set up unix socket */
931 this->socket = socket(AF_UNIX, SOCK_STREAM, 0);
932 if (this->socket == -1)
933 {
934 this->logger->log(this->logger, ERROR, "could not create whack socket");
935 charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
936 allocator_free(this);
937 return NULL;
938 }
939 if (fcntl(this->socket, F_SETFD, FD_CLOEXEC) < 0)
940 {
941 this->logger->log(this->logger, ERROR, "could not FD_CLOEXEC on whack socket");
942 charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
943 close(this->socket);
944 allocator_free(this);
945 return NULL;
946 }
947 if (setsockopt(this->socket, SOL_SOCKET, SO_REUSEADDR, (const void *)&on, sizeof(on)) < 0)
948
949 old = umask(~S_IRWXU);
950 if (bind(this->socket, (struct sockaddr *)&socket_addr, sizeof(socket_addr)) < 0)
951 {
952 this->logger->log(this->logger, ERROR, "could not bind whack socket: %s", strerror(errno));
953 charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
954 close(this->socket);
955 allocator_free(this);
956 return NULL;
957 }
958 umask(old);
959
960 if (listen(this->socket, 0) < 0)
961 {
962 this->logger->log(this->logger, ERROR, "could not listen on whack socket: %s", strerror(errno));
963 charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
964 close(this->socket);
965 unlink(socket_addr.sun_path);
966 allocator_free(this);
967 return NULL;
968 }
969
970 /* start a thread reading from the socket */
971 if (pthread_create(&(this->assigned_thread), NULL, (void*(*)(void*))this->whack_receive, this) != 0)
972 {
973 this->logger->log(this->logger, ERROR, "Could not spawn whack thread");
974 charon->logger_manager->destroy_logger(charon->logger_manager, this->logger);
975 close(this->socket);
976 unlink(socket_addr.sun_path);
977 allocator_free(this);
978 }
979
980 /* private variables */
981 this->configurations = linked_list_create();
982 this->sa_configs = linked_list_create();
983 this->init_configs = linked_list_create();
984 this->preshared_secrets = linked_list_create();
985 this->rsa_private_keys = linked_list_create();
986 this->rsa_public_keys = linked_list_create();
987 this->max_retransmit_count = MAX_RETRANSMIT_COUNT;
988 this->first_retransmit_timeout = RETRANSMIT_TIMEOUT;
989 this->half_open_ike_sa_timeout = HALF_OPEN_IKE_SA_TIMEOUT;
990
991 return (&this->public);
992 }