charon-cmd: add support for using dynamic ports in charon-cmd
[strongswan.git] / src / charon-cmd / cmd / cmd_connection.c
1 /*
2 * Copyright (C) 2013 Martin Willi
3 * Copyright (C) 2013 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "cmd_connection.h"
17
18 #include <signal.h>
19 #include <unistd.h>
20
21 #include <utils/debug.h>
22 #include <processing/jobs/callback_job.h>
23 #include <daemon.h>
24
25 typedef struct private_cmd_connection_t private_cmd_connection_t;
26
27 /**
28 * Private data of an cmd_connection_t object.
29 */
30 struct private_cmd_connection_t {
31
32 /**
33 * Public cmd_connection_t interface.
34 */
35 cmd_connection_t public;
36
37 /**
38 * Process ID to terminate on failure
39 */
40 pid_t pid;
41
42 /**
43 * Hostname to connect to
44 */
45 char *host;
46
47 /**
48 * Local identity
49 */
50 char *identity;
51 };
52
53 /**
54 * Shut down application
55 */
56 static void terminate(private_cmd_connection_t *this)
57 {
58 kill(this->pid, SIGUSR1);
59 }
60
61 /**
62 * Create peer config with associated ike config
63 */
64 static peer_cfg_t* create_peer_cfg(private_cmd_connection_t *this)
65 {
66 ike_cfg_t *ike_cfg;
67 peer_cfg_t *peer_cfg;
68 u_int16_t local_port, remote_port = IKEV2_UDP_PORT;
69
70 local_port = charon->socket->get_port(charon->socket, FALSE);
71 if (local_port != IKEV2_UDP_PORT)
72 {
73 remote_port = IKEV2_NATT_PORT;
74 }
75 ike_cfg = ike_cfg_create(IKEV2, TRUE, FALSE, "0.0.0.0", FALSE, local_port,
76 this->host, FALSE, remote_port, FRAGMENTATION_NO, 0);
77 ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
78 peer_cfg = peer_cfg_create("cmd", ike_cfg,
79 CERT_SEND_IF_ASKED, UNIQUE_REPLACE, 1, /* keyingtries */
80 36000, 0, /* rekey 10h, reauth none */
81 600, 600, /* jitter, over 10min */
82 TRUE, FALSE, /* mobike, aggressive */
83 30, 0, /* DPD delay, timeout */
84 FALSE, NULL, NULL); /* mediation */
85 peer_cfg->add_virtual_ip(peer_cfg, host_create_from_string("0.0.0.0", 0));
86
87 return peer_cfg;
88 }
89
90 /**
91 * Attach authentication configs to peer config
92 */
93 static void add_auth_cfgs(private_cmd_connection_t *this, peer_cfg_t *peer_cfg)
94 {
95 auth_cfg_t *auth;
96
97 auth = auth_cfg_create();
98 auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
99 auth->add(auth, AUTH_RULE_IDENTITY,
100 identification_create_from_string(this->identity));
101 peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
102
103 auth = auth_cfg_create();
104
105 auth->add(auth, AUTH_RULE_IDENTITY,
106 identification_create_from_string(this->host));
107 peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
108 }
109
110 /**
111 * Attach child config to peer config
112 */
113 static child_cfg_t* create_child_cfg(private_cmd_connection_t *this)
114 {
115 child_cfg_t *child_cfg;
116 traffic_selector_t *ts;
117 lifetime_cfg_t lifetime = {
118 .time = {
119 .life = 10800 /* 3h */,
120 .rekey = 10200 /* 2h50min */,
121 .jitter = 300 /* 5min */
122 }
123 };
124
125 child_cfg = child_cfg_create("cmd", &lifetime,
126 NULL, FALSE, MODE_TUNNEL, /* updown, hostaccess */
127 ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
128 0, 0, NULL, NULL, 0);
129 child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
130 ts = traffic_selector_create_dynamic(0, 0, 65535);
131 child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
132 ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE,
133 "0.0.0.0", 0, "255.255.255.255", 65535);
134 child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
135
136 return child_cfg;
137 }
138
139 /**
140 * Initiate the configured connection
141 */
142 static job_requeue_t initiate(private_cmd_connection_t *this)
143 {
144 peer_cfg_t *peer_cfg;
145 child_cfg_t *child_cfg;
146
147 if (!this->host)
148 {
149 DBG1(DBG_CFG, "unable to initiate, missing --host option");
150 terminate(this);
151 return JOB_REQUEUE_NONE;
152 }
153 if (!this->identity)
154 {
155 DBG1(DBG_CFG, "unable to initiate, missing --identity option");
156 terminate(this);
157 return JOB_REQUEUE_NONE;
158 }
159
160 peer_cfg = create_peer_cfg(this);
161
162 add_auth_cfgs(this, peer_cfg);
163
164 child_cfg = create_child_cfg(this);
165 peer_cfg->add_child_cfg(peer_cfg, child_cfg->get_ref(child_cfg));
166
167 if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
168 controller_cb_empty, NULL, 0) != SUCCESS)
169 {
170 terminate(this);
171 }
172 return JOB_REQUEUE_NONE;
173 }
174
175 METHOD(cmd_connection_t, handle, bool,
176 private_cmd_connection_t *this, cmd_option_type_t opt, char *arg)
177 {
178 switch (opt)
179 {
180 case CMD_OPT_HOST:
181 this->host = arg;
182 break;
183 case CMD_OPT_IDENTITY:
184 this->identity = arg;
185 break;
186 default:
187 return FALSE;
188 }
189 return TRUE;
190 }
191
192 METHOD(cmd_connection_t, destroy, void,
193 private_cmd_connection_t *this)
194 {
195 free(this);
196 }
197
198 /**
199 * See header
200 */
201 cmd_connection_t *cmd_connection_create()
202 {
203 private_cmd_connection_t *this;
204
205 INIT(this,
206 .public = {
207 .handle = _handle,
208 .destroy = _destroy,
209 },
210 .pid = getpid(),
211 );
212
213 /* queue job, gets initiated as soon as we are up and running */
214 lib->processor->queue_job(lib->processor,
215 (job_t*)callback_job_create_with_prio(
216 (callback_job_cb_t)initiate, this, NULL,
217 (callback_job_cancel_t)return_false, JOB_PRIO_CRITICAL));
218
219 return &this->public;
220 }