src/charon-cmd/cmd/cmd_connection.c

   1 /*
   2  * Copyright (C) 2013 Martin Willi
   3  * Copyright (C) 2013 revosec AG
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "cmd_connection.h"
  17
  18 #include <signal.h>
  19 #include <unistd.h>
  20
  21 #include <utils/debug.h>
  22 #include <processing/jobs/callback_job.h>
  23 #include <daemon.h>
  24
  25 typedef struct private_cmd_connection_t private_cmd_connection_t;
  26
  27 /**
  28  * Private data of an cmd_connection_t object.
  29  */
  30 struct private_cmd_connection_t {
  31
  32         /**
  33          * Public cmd_connection_t interface.
  34          */
  35         cmd_connection_t public;
  36
  37         /**
  38          * Process ID to terminate on failure
  39          */
  40         pid_t pid;
  41
  42         /**
  43          * Hostname to connect to
  44          */
  45         char *host;
  46
  47         /**
  48          * Local identity
  49          */
  50         char *identity;
  51 };
  52
  53 /**
  54  * Shut down application
  55  */
  56 static void terminate(private_cmd_connection_t *this)
  57 {
  58         kill(this->pid, SIGUSR1);
  59 }
  60
  61 /**
  62  * Create peer config with associated ike config
  63  */
  64 static peer_cfg_t* create_peer_cfg(private_cmd_connection_t *this)
  65 {
  66         ike_cfg_t *ike_cfg;
  67         peer_cfg_t *peer_cfg;
  68         u_int16_t local_port, remote_port = IKEV2_UDP_PORT;
  69
  70         local_port = charon->socket->get_port(charon->socket, FALSE);
  71         if (local_port != IKEV2_UDP_PORT)
  72         {
  73                 remote_port = IKEV2_NATT_PORT;
  74         }
  75         ike_cfg = ike_cfg_create(IKEV2, TRUE, FALSE, "0.0.0.0", FALSE, local_port,
  76                                         this->host, FALSE, remote_port, FRAGMENTATION_NO, 0);
  77         ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
  78         peer_cfg = peer_cfg_create("cmd", ike_cfg,
  79                                         CERT_SEND_IF_ASKED, UNIQUE_REPLACE, 1, /* keyingtries */
  80                                         36000, 0, /* rekey 10h, reauth none */
  81                                         600, 600, /* jitter, over 10min */
  82                                         TRUE, FALSE, /* mobike, aggressive */
  83                                         30, 0, /* DPD delay, timeout */
  84                                         FALSE, NULL, NULL); /* mediation */
  85         peer_cfg->add_virtual_ip(peer_cfg, host_create_from_string("0.0.0.0", 0));
  86
  87         return peer_cfg;
  88 }
  89
  90 /**
  91  * Attach authentication configs to peer config
  92  */
  93 static void add_auth_cfgs(private_cmd_connection_t *this, peer_cfg_t *peer_cfg)
  94 {
  95         auth_cfg_t *auth;
  96
  97         auth = auth_cfg_create();
  98         auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
  99         auth->add(auth, AUTH_RULE_IDENTITY,
 100                           identification_create_from_string(this->identity));
 101         peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
 102
 103         auth = auth_cfg_create();
 104
 105         auth->add(auth, AUTH_RULE_IDENTITY,
 106                           identification_create_from_string(this->host));
 107         peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
 108 }
 109
 110 /**
 111  * Attach child config to peer config
 112  */
 113 static child_cfg_t* create_child_cfg(private_cmd_connection_t *this)
 114 {
 115         child_cfg_t *child_cfg;
 116         traffic_selector_t *ts;
 117         lifetime_cfg_t lifetime = {
 118                 .time = {
 119                         .life = 10800 /* 3h */,
 120                         .rekey = 10200 /* 2h50min */,
 121                         .jitter = 300 /* 5min */
 122                 }
 123         };
 124
 125         child_cfg = child_cfg_create("cmd", &lifetime,
 126                                                                  NULL, FALSE, MODE_TUNNEL, /* updown, hostaccess */
 127                                                                  ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
 128                                                                  0, 0, NULL, NULL, 0);
 129         child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
 130         ts = traffic_selector_create_dynamic(0, 0, 65535);
 131         child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
 132         ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE,
 133                                                                         "0.0.0.0", 0, "255.255.255.255", 65535);
 134         child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
 135
 136         return child_cfg;
 137 }
 138
 139 /**
 140  * Initiate the configured connection
 141  */
 142 static job_requeue_t initiate(private_cmd_connection_t *this)
 143 {
 144         peer_cfg_t *peer_cfg;
 145         child_cfg_t *child_cfg;
 146
 147         if (!this->host)
 148         {
 149                 DBG1(DBG_CFG, "unable to initiate, missing --host option");
 150                 terminate(this);
 151                 return JOB_REQUEUE_NONE;
 152         }
 153         if (!this->identity)
 154         {
 155                 DBG1(DBG_CFG, "unable to initiate, missing --identity option");
 156                 terminate(this);
 157                 return JOB_REQUEUE_NONE;
 158         }
 159
 160         peer_cfg = create_peer_cfg(this);
 161
 162         add_auth_cfgs(this, peer_cfg);
 163
 164         child_cfg = create_child_cfg(this);
 165         peer_cfg->add_child_cfg(peer_cfg, child_cfg->get_ref(child_cfg));
 166
 167         if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
 168                                                                          controller_cb_empty, NULL, 0) != SUCCESS)
 169         {
 170                 terminate(this);
 171         }
 172         return JOB_REQUEUE_NONE;
 173 }
 174
 175 METHOD(cmd_connection_t, handle, bool,
 176         private_cmd_connection_t *this, cmd_option_type_t opt, char *arg)
 177 {
 178         switch (opt)
 179         {
 180                 case CMD_OPT_HOST:
 181                         this->host = arg;
 182                         break;
 183                 case CMD_OPT_IDENTITY:
 184                         this->identity = arg;
 185                         break;
 186                 default:
 187                         return FALSE;
 188         }
 189         return TRUE;
 190 }
 191
 192 METHOD(cmd_connection_t, destroy, void,
 193         private_cmd_connection_t *this)
 194 {
 195         free(this);
 196 }
 197
 198 /**
 199  * See header
 200  */
 201 cmd_connection_t *cmd_connection_create()
 202 {
 203         private_cmd_connection_t *this;
 204
 205         INIT(this,
 206                 .public = {
 207                         .handle = _handle,
 208                         .destroy = _destroy,
 209                 },
 210                 .pid = getpid(),
 211         );
 212
 213         /* queue job, gets initiated as soon as we are up and running */
 214         lib->processor->queue_job(lib->processor,
 215                 (job_t*)callback_job_create_with_prio(
 216                         (callback_job_cb_t)initiate, this, NULL,
 217                         (callback_job_cancel_t)return_false, JOB_PRIO_CRITICAL));
 218
 219         return &this->public;
 220 }