- belongs to previous commit ;-)
[strongswan.git] / Source / charon / threads / stroke.c
1 /**
2 * @file stroke.c
3 *
4 * @brief Implementation of stroke_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2006 Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include <stdlib.h>
24 #include <sys/types.h>
25 #include <sys/stat.h>
26 #include <sys/socket.h>
27 #include <sys/un.h>
28 #include <sys/fcntl.h>
29 #include <unistd.h>
30 #include <errno.h>
31 #include <pthread.h>
32
33 #include "stroke.h"
34
35 #include <types.h>
36 #include <daemon.h>
37 #include <utils/allocator.h>
38 #include <queues/jobs/initiate_ike_sa_job.h>
39
40
41 struct sockaddr_un socket_addr = { AF_UNIX, STROKE_SOCKET};
42
43 typedef struct configuration_entry_t configuration_entry_t;
44
45 /**
46 * A configuration entry combines a configuration name with a connection
47 * and a policy.
48 *
49 * @b Constructors:
50 * - configuration_entry_create()
51 */
52 struct configuration_entry_t {
53
54 /**
55 * Configuration name.
56 *
57 */
58 char *name;
59
60 /**
61 * Configuration for IKE_SA_INIT exchange.
62 */
63 connection_t *connection;
64
65 /**
66 * Configuration for all phases after IKE_SA_INIT exchange.
67 */
68 policy_t *policy;
69
70 /**
71 * Destroys a configuration_entry_t
72 */
73 void (*destroy) (configuration_entry_t *this);
74 };
75
76 /**
77 * Implementation of configuration_entry_t.destroy.
78 */
79 static void configuration_entry_destroy (configuration_entry_t *this)
80 {
81 this->connection->destroy(this->connection);
82 this->policy->destroy(this->policy);
83 allocator_free(this->name);
84 allocator_free(this);
85 }
86
87 /**
88 * Creates a configuration_entry_t object.
89 */
90 static configuration_entry_t * configuration_entry_create(char *name, connection_t* connection, policy_t *policy)
91 {
92 configuration_entry_t *entry = allocator_alloc_thing(configuration_entry_t);
93
94 /* functions */
95 entry->destroy = configuration_entry_destroy;
96
97 /* private data */
98 entry->connection = connection;
99 entry->policy = policy;
100 entry->name = allocator_alloc(strlen(name) + 1);
101 strcpy(entry->name, name);
102
103 return entry;
104 }
105
106 typedef struct private_stroke_t private_stroke_t;
107
108 /**
109 * Private data of an stroke_t object.
110 */
111 struct private_stroke_t {
112
113 /**
114 * Public part of stroke_t object.
115 */
116 stroke_t public;
117
118 /**
119 * Holding all configurations.
120 */
121 linked_list_t *configurations;
122
123 /**
124 * Assigned logger_t object.
125 */
126 logger_t *logger;
127
128 /**
129 * Unix socket to use for communication
130 */
131 int socket;
132
133 /**
134 * Thread which reads from the socket
135 */
136 pthread_t assigned_thread;
137
138 /**
139 * Read from the socket and handle stroke messages
140 */
141 void (*stroke_receive) (private_stroke_t *this);
142
143 /**
144 * find a connection in the config list by name
145 */
146 connection_t *(*get_connection_by_name) (private_stroke_t *this, char *name);
147 };
148
149 /**
150 * Helper function which corrects the string pointers
151 * in a stroke_msg_t. Strings in a stroke_msg sent over wire
152 * contain RELATIVE addresses (relative to the beginning of the
153 * stroke_msg). They must be corrected if they reach our address
154 * space...
155 */
156 static void fix_string(stroke_msg_t *msg, char **string)
157 {
158 /* check for sanity of string pointer and string */
159 if (string < (char**)msg ||
160 string > (char**)msg + sizeof(stroke_msg_t) ||
161 *string < (char*)msg->buffer - (u_int)msg ||
162 *string > (char*)(u_int)msg->length)
163 {
164 *string = "(invalid char* in stroke msg)";
165 }
166 else
167 {
168 *string = (char*)msg + (u_int)*string;
169 }
170 }
171
172 /**
173 * Implementation of private_stroke_t.stroke_receive.
174 */
175 static void stroke_receive(private_stroke_t *this)
176 {
177 stroke_msg_t *msg;
178 u_int16_t msg_length;
179 struct sockaddr_un strokeaddr;
180 int strokeaddrlen = sizeof(strokeaddr);
181 ssize_t bytes_read;
182 int strokefd;
183
184 while (1)
185 {
186 strokefd = accept(this->socket, (struct sockaddr *)&strokeaddr, &strokeaddrlen);
187
188 if (strokefd < 0)
189 {
190 this->logger->log(this->logger, ERROR, "accepting stroke connection failed");
191 continue;
192 }
193
194 /* peek the length */
195 bytes_read = recv(strokefd, &msg_length, sizeof(msg_length), MSG_PEEK);
196 if (bytes_read != sizeof(msg_length))
197 {
198 this->logger->log(this->logger, ERROR, "reading lenght of stroke message failed");
199 close(strokefd);
200 continue;
201 }
202
203 /* read message */
204 msg = allocator_alloc(msg_length);
205 bytes_read = recv(strokefd, msg, msg_length, 0);
206 if (bytes_read != msg_length)
207 {
208 this->logger->log(this->logger, ERROR, "reading stroke message failed");
209 close(strokefd);
210 continue;
211 }
212
213 this->logger->log_bytes(this->logger, RAW|LEVEL1, "stroke message", (void*)msg, msg_length);
214
215 switch (msg->type)
216 {
217 case STR_INITIATE:
218 {
219 initiate_ike_sa_job_t *job;
220 connection_t *connection;
221 fix_string(msg, &(msg->initiate.name));
222 this->logger->log(this->logger, CONTROL|LEVEL1, "received stroke: initiate \"%s\"", msg->initiate.name);
223 connection = this->get_connection_by_name(this, msg->initiate.name);
224 if (connection == NULL)
225 {
226 this->logger->log(this->logger, ERROR, "could not find a connection named \"%s\"", msg->initiate.name);
227 }
228 else
229 {
230 job = initiate_ike_sa_job_create(connection);
231 charon->job_queue->add(charon->job_queue, (job_t*)job);
232 }
233 break;
234 }
235 case STR_INSTALL:
236 {
237 fix_string(msg, &(msg->install.name));
238 this->logger->log(this->logger, CONTROL|LEVEL1, "received stroke: install \"%s\"", msg->install.name);
239 break;
240 }
241 case STR_ADD_CONN:
242 {
243 connection_t *connection;
244 policy_t *policy;
245 identification_t *my_id, *other_id;
246 host_t *my_host, *other_host, *my_subnet, *other_subnet;
247 proposal_t *proposal;
248 traffic_selector_t *ts;
249 chunk_t chunk;
250
251 fix_string(msg, &msg->add_conn.name);
252 this->logger->log(this->logger, CONTROL|LEVEL1, "received stroke: add connection \"%s\"", msg->add_conn.name);
253
254 msg->add_conn.me.address.v4.sin_port = htons(500);
255 msg->add_conn.other.address.v4.sin_port = htons(500);
256 my_host = host_create_from_sockaddr(&msg->add_conn.me.address.saddr);
257 other_host = host_create_from_sockaddr(&msg->add_conn.other.address.saddr);
258
259 fix_string(msg, &msg->add_conn.me.id);
260 fix_string(msg, &msg->add_conn.other.id);
261 my_id = identification_create_from_string(ID_IPV4_ADDR, msg->add_conn.me.id);
262 other_id = identification_create_from_string(ID_IPV4_ADDR, msg->add_conn.other.id);
263
264 connection = connection_create(my_host, other_host, my_id->clone(my_id), other_id->clone(other_id), SHARED_KEY_MESSAGE_INTEGRITY_CODE);
265 proposal = proposal_create(1);
266 proposal->add_algorithm(proposal, IKE, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
267 proposal->add_algorithm(proposal, IKE, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 0);
268 proposal->add_algorithm(proposal, IKE, PSEUDO_RANDOM_FUNCTION, PRF_HMAC_SHA1, 0);
269 proposal->add_algorithm(proposal, IKE, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
270 connection->add_proposal(connection, proposal);
271
272 policy = policy_create(my_id, other_id);
273 proposal = proposal_create(1);
274 proposal->add_algorithm(proposal, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
275 proposal->add_algorithm(proposal, ESP, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 0);
276 policy->add_proposal(policy, proposal);
277
278 my_subnet = host_create_from_sockaddr(&msg->add_conn.me.subnet.saddr);
279 ts = traffic_selector_create_from_subnet(my_subnet, msg->add_conn.me.subnet_netbits);
280 my_subnet->destroy(my_subnet);
281 policy->add_my_traffic_selector(policy, ts);
282
283 other_subnet = host_create_from_sockaddr(&msg->add_conn.other.subnet.saddr);
284 ts = traffic_selector_create_from_subnet(other_subnet, msg->add_conn.other.subnet_netbits);
285 other_subnet->destroy(other_subnet);
286 policy->add_other_traffic_selector(policy, ts);
287
288 this->configurations->insert_last(this->configurations,
289 configuration_entry_create(msg->add_conn.name, connection, policy));
290
291 this->logger->log(this->logger, CONTROL|LEVEL1, "connection \"%s\" added (%d in store)",
292 msg->add_conn.name,
293 this->configurations->get_count(this->configurations));
294
295 break;
296 }
297 case STR_DEL_CONN:
298 default:
299 this->logger->log(this->logger, ERROR, "received invalid stroke");
300 }
301
302 allocator_free(msg);
303 }
304 }
305
306
307 /**
308 * Implementation of connection_store_t.get_connection_by_hosts.
309 */
310 static connection_t *get_connection_by_hosts(connection_store_t *store, host_t *my_host, host_t *other_host)
311 {
312 private_stroke_t *this = (private_stroke_t*)((u_int8_t*)store - offsetof(stroke_t, connections));
313 iterator_t *iterator;
314 connection_t *found = NULL;
315
316 this->logger->log(this->logger, CONTROL|LEVEL1, "getting config for hosts %s - %s",
317 my_host->get_address(my_host), other_host->get_address(other_host));
318
319 iterator = this->configurations->create_iterator(this->configurations,TRUE);
320 while (iterator->has_next(iterator))
321 {
322 configuration_entry_t *entry;
323 host_t *config_my_host, *config_other_host;
324
325 iterator->current(iterator,(void **) &entry);
326
327 config_my_host = entry->connection->get_my_host(entry->connection);
328 config_other_host = entry->connection->get_other_host(entry->connection);
329
330 /* first check if ip is equal */
331 if(config_other_host->ip_is_equal(config_other_host, other_host))
332 {
333 this->logger->log(this->logger, CONTROL|LEVEL2, "config entry with remote host %s",
334 config_other_host->get_address(config_other_host));
335 /* could be right one, check my_host for default route*/
336 if (config_my_host->is_default_route(config_my_host))
337 {
338 found = entry->connection;
339 break;
340 }
341 /* check now if host informations are the same */
342 else if (config_my_host->ip_is_equal(config_my_host,my_host))
343 {
344 found = entry->connection;
345 break;
346 }
347
348 }
349 /* Then check for wildcard hosts!
350 * TODO
351 * actually its only checked if other host with default route can be found! */
352 else if (config_other_host->is_default_route(config_other_host))
353 {
354 /* could be right one, check my_host for default route*/
355 if (config_my_host->is_default_route(config_my_host))
356 {
357 found = entry->connection;
358 break;
359 }
360 /* check now if host informations are the same */
361 else if (config_my_host->ip_is_equal(config_my_host,my_host))
362 {
363 found = entry->connection;
364 break;
365 }
366 }
367 }
368 iterator->destroy(iterator);
369
370 return found;
371 }
372
373 /**
374 * Implementation of connection_store_t.get_connection_by_ids.
375 */
376 static connection_t *get_connection_by_ids(connection_store_t *store, identification_t *my_id, identification_t *other_id)
377 {
378 private_stroke_t *this = (private_stroke_t*)((u_int8_t*)store - offsetof(stroke_t, connections));
379 iterator_t *iterator;
380 connection_t *found = NULL;
381
382 this->logger->log(this->logger, CONTROL|LEVEL1, "getting config for ids %s - %s",
383 my_id->get_string(my_id), other_id->get_string(other_id));
384
385 iterator = this->configurations->create_iterator(this->configurations,TRUE);
386 while (iterator->has_next(iterator))
387 {
388 configuration_entry_t *entry;
389 identification_t *config_my_id, *config_other_id;
390
391 iterator->current(iterator,(void **) &entry);
392
393 config_my_id = entry->connection->get_my_id(entry->connection);
394 config_other_id = entry->connection->get_other_id(entry->connection);
395
396 /* first check if ids are equal
397 * TODO: Add wildcard checks */
398 if (config_other_id->equals(config_other_id, other_id) &&
399 config_my_id->equals(config_my_id, my_id))
400 {
401 this->logger->log(this->logger, CONTROL|LEVEL2, "config entry with remote id %s",
402 config_other_id->get_string(config_other_id));
403 found = entry->connection;
404 break;
405 }
406 }
407 iterator->destroy(iterator);
408
409 return found;
410 }
411
412 /**
413 * Implementation of private_stroke_t.get_connection_by_name.
414 */
415 static connection_t *get_connection_by_name(private_stroke_t *this, char *name)
416 {
417 iterator_t *iterator;
418 connection_t *found = NULL;
419
420 iterator = this->configurations->create_iterator(this->configurations, TRUE);
421 while (iterator->has_next(iterator))
422 {
423 configuration_entry_t *entry;
424 iterator->current(iterator,(void **) &entry);
425
426 if (strcmp(entry->name,name) == 0)
427 {
428 /* found configuration */
429 found = entry->connection;
430 break;
431 }
432 }
433 iterator->destroy(iterator);
434
435 return found;
436 }
437
438 /**
439 * Implementation of policy_store_t.get_policy.
440 */
441 static policy_t *get_policy(policy_store_t *store,identification_t *my_id, identification_t *other_id)
442 {
443 private_stroke_t *this = (private_stroke_t*)((u_int8_t*)store - offsetof(stroke_t, policies));
444 iterator_t *iterator;
445 policy_t *found = NULL;
446
447 iterator = this->configurations->create_iterator(this->configurations, TRUE);
448 while (iterator->has_next(iterator))
449 {
450 configuration_entry_t *entry;
451 iterator->current(iterator,(void **) &entry);
452 identification_t *config_my_id = entry->policy->get_my_id(entry->policy);
453 identification_t *config_other_id = entry->policy->get_other_id(entry->policy);
454
455 /* host informations seem to be the same */
456 if (config_other_id->equals(config_other_id, other_id))
457 {
458 /* other ids seems to match */
459 if (my_id == NULL)
460 {
461 /* first matching one is selected */
462 /* TODO priorize found entries */
463 found = entry->policy;
464 break;
465 }
466
467 if (config_my_id->equals(config_my_id, my_id))
468 {
469 found = entry->policy;
470 break;
471 }
472
473 }
474 }
475 iterator->destroy(iterator);
476
477 return found;
478 }
479
480
481 static status_t get_shared_secret(credential_store_t *this, identification_t *identification, chunk_t *preshared_secret)
482 {
483 char *secret = "schluessel";
484 preshared_secret->ptr = secret;
485 preshared_secret->len = strlen(secret) + 1;
486 return SUCCESS;
487 }
488
489 static status_t get_rsa_public_key(credential_store_t *this, identification_t *identification, rsa_public_key_t **public_key)
490 {
491 return FAILED;
492 }
493
494 static status_t get_rsa_private_key(credential_store_t *this, identification_t *identification, rsa_private_key_t **private_key)
495 {
496 return FAILED;
497 }
498
499
500
501
502 /**
503 * Implementation of stroke_t.destroy.
504 */
505 static void destroy(private_stroke_t *this)
506 {
507 configuration_entry_t *entry;
508 while (this->configurations->remove_first(this->configurations, (void **)&entry) == SUCCESS)
509 {
510 entry->destroy(entry);
511 }
512 this->configurations->destroy(this->configurations);
513
514 charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
515 close(this->socket);
516 unlink(socket_addr.sun_path);
517 allocator_free(this);
518 }
519
520 /**
521 * Dummy function which does nothing.
522 * Used for connection_store_t.destroy and policy_store_t.destroy,
523 * since destruction is done in store_t's destructor...
524 */
525 void do_nothing(void *nothing)
526 {
527 return;
528 }
529
530 /*
531 * Described in header-file
532 */
533 stroke_t *stroke_create()
534 {
535 private_stroke_t *this = allocator_alloc_thing(private_stroke_t);
536 mode_t old;
537
538 /* public functions */
539 this->public.connections.get_connection_by_ids = get_connection_by_ids;
540 this->public.connections.get_connection_by_hosts = get_connection_by_hosts;
541 this->public.connections.destroy = (void (*) (connection_store_t*))do_nothing;
542 this->public.policies.get_policy = get_policy;
543 this->public.policies.destroy = (void (*) (policy_store_t*))do_nothing;
544 this->public.credentials.get_shared_secret = (status_t (*)(credential_store_t*,identification_t*,chunk_t*))get_shared_secret;
545 this->public.credentials.get_rsa_public_key = (status_t (*)(credential_store_t*,identification_t*,rsa_public_key_t**))get_rsa_public_key;
546 this->public.credentials.get_rsa_private_key = (status_t (*)(credential_store_t*,identification_t*,rsa_private_key_t**))get_rsa_private_key;
547 this->public.credentials.destroy = (void (*) (credential_store_t*))do_nothing;
548 this->public.destroy = (void (*)(stroke_t*))destroy;
549
550 /* private functions */
551 this->stroke_receive = stroke_receive;
552 this->get_connection_by_name = get_connection_by_name;
553
554 this->logger = charon->logger_manager->create_logger(charon->logger_manager,CONFIG,NULL);
555
556 /* set up unix socket */
557 this->socket = socket(AF_UNIX, SOCK_STREAM, 0);
558 if (this->socket == -1)
559 {
560 this->logger->log(this->logger, ERROR, "could not create whack socket");
561 charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
562 allocator_free(this);
563 return NULL;
564 }
565
566 old = umask(~S_IRWXU);
567 if (bind(this->socket, (struct sockaddr *)&socket_addr, sizeof(socket_addr)) < 0)
568 {
569 this->logger->log(this->logger, ERROR, "could not bind stroke socket: %s", strerror(errno));
570 charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
571 close(this->socket);
572 allocator_free(this);
573 return NULL;
574 }
575 umask(old);
576
577 if (listen(this->socket, 0) < 0)
578 {
579 this->logger->log(this->logger, ERROR, "could not listen on stroke socket: %s", strerror(errno));
580 charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
581 close(this->socket);
582 unlink(socket_addr.sun_path);
583 allocator_free(this);
584 return NULL;
585 }
586
587 /* start a thread reading from the socket */
588 if (pthread_create(&(this->assigned_thread), NULL, (void*(*)(void*))this->stroke_receive, this) != 0)
589 {
590 this->logger->log(this->logger, ERROR, "Could not spawn stroke thread");
591 charon->logger_manager->destroy_logger(charon->logger_manager, this->logger);
592 close(this->socket);
593 unlink(socket_addr.sun_path);
594 allocator_free(this);
595 }
596
597 /* private variables */
598 this->configurations = linked_list_create();
599
600 return (&this->public);
601 }