2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
18 #include "stroke_list.h"
21 #include <credentials/certificates/x509.h>
22 #include <credentials/certificates/crl.h>
24 /* warning intervals for list functions */
25 #define CERT_WARNING_INTERVAL 30 /* days */
26 #define CRL_WARNING_INTERVAL 7 /* days */
28 typedef struct private_stroke_list_t private_stroke_list_t
;
31 * private data of stroke_list
33 struct private_stroke_list_t
{
41 * timestamp of daemon start
47 * log an IKE_SA to out
49 static void log_ike_sa(FILE *out
, ike_sa_t
*ike_sa
, bool all
)
51 ike_sa_id_t
*id
= ike_sa
->get_id(ike_sa
);
52 u_int32_t rekey
, reauth
;
54 fprintf(out
, "%12s[%d]: %N, %H[%D]...%H[%D]\n",
55 ike_sa
->get_name(ike_sa
), ike_sa
->get_unique_id(ike_sa
),
56 ike_sa_state_names
, ike_sa
->get_state(ike_sa
),
57 ike_sa
->get_my_host(ike_sa
), ike_sa
->get_my_id(ike_sa
),
58 ike_sa
->get_other_host(ike_sa
), ike_sa
->get_other_id(ike_sa
));
62 fprintf(out
, "%12s[%d]: IKE SPIs: %.16llx_i%s %.16llx_r%s",
63 ike_sa
->get_name(ike_sa
), ike_sa
->get_unique_id(ike_sa
),
64 id
->get_initiator_spi(id
), id
->is_initiator(id
) ?
"*" : "",
65 id
->get_responder_spi(id
), id
->is_initiator(id
) ?
"" : "*");
67 rekey
= ike_sa
->get_statistic(ike_sa
, STAT_REKEY_TIME
);
68 reauth
= ike_sa
->get_statistic(ike_sa
, STAT_REAUTH_TIME
);
71 fprintf(out
, ", rekeying in %V", &rekey
);
75 fprintf(out
, ", reauthentication in %V", &reauth
);
77 if (!rekey
&& !reauth
)
79 fprintf(out
, ", rekeying disabled");
86 * log an CHILD_SA to out
88 static void log_child_sa(FILE *out
, child_sa_t
*child_sa
, bool all
)
90 u_int32_t rekey
, now
= time(NULL
);
91 u_int32_t use_in
, use_out
, use_fwd
;
92 encryption_algorithm_t encr_alg
;
93 integrity_algorithm_t int_alg
;
94 size_t encr_len
, int_len
;
97 child_sa
->get_stats(child_sa
, &mode
, &encr_alg
, &encr_len
,
98 &int_alg
, &int_len
, &rekey
, &use_in
, &use_out
,
101 fprintf(out
, "%12s{%d}: %N, %N",
102 child_sa
->get_name(child_sa
), child_sa
->get_reqid(child_sa
),
103 child_sa_state_names
, child_sa
->get_state(child_sa
),
106 if (child_sa
->get_state(child_sa
) == CHILD_INSTALLED
)
108 fprintf(out
, ", %N SPIs: %.8x_i %.8x_o",
109 protocol_id_names
, child_sa
->get_protocol(child_sa
),
110 htonl(child_sa
->get_spi(child_sa
, TRUE
)),
111 htonl(child_sa
->get_spi(child_sa
, FALSE
)));
115 fprintf(out
, "\n%12s{%d}: ", child_sa
->get_name(child_sa
),
116 child_sa
->get_reqid(child_sa
));
119 if (child_sa
->get_protocol(child_sa
) == PROTO_ESP
)
121 fprintf(out
, "%N", encryption_algorithm_names
, encr_alg
);
125 fprintf(out
, "-%d", encr_len
);
130 fprintf(out
, "%N", integrity_algorithm_names
, int_alg
);
133 fprintf(out
, "-%d", int_len
);
135 fprintf(out
, ", rekeying ");
139 fprintf(out
, "in %#V", &now
, &rekey
);
143 fprintf(out
, "disabled");
146 fprintf(out
, ", last use: ");
147 use_in
= max(use_in
, use_fwd
);
150 fprintf(out
, "%ds_i ", now
- use_in
);
154 fprintf(out
, "no_i ");
158 fprintf(out
, "%ds_o ", now
- use_out
);
162 fprintf(out
, "no_o ");
167 fprintf(out
, "\n%12s{%d}: %#R=== %#R\n",
168 child_sa
->get_name(child_sa
), child_sa
->get_reqid(child_sa
),
169 child_sa
->get_traffic_selectors(child_sa
, TRUE
),
170 child_sa
->get_traffic_selectors(child_sa
, FALSE
));
174 * Implementation of stroke_list_t.status.
176 static void status(private_stroke_list_t
*this, stroke_msg_t
*msg
, FILE *out
, bool all
)
178 enumerator_t
*enumerator
, *children
;
179 iterator_t
*iterator
;
181 peer_cfg_t
*peer_cfg
;
183 child_cfg_t
*child_cfg
;
188 name
= msg
->status
.name
;
192 uptime
= time(NULL
) - this->uptime
;
193 fprintf(out
, "Performance:\n");
194 fprintf(out
, " uptime: %V, since %#T\n", &uptime
, &this->uptime
, FALSE
);
195 fprintf(out
, " worker threads: %d idle of %d,",
196 charon
->processor
->get_idle_threads(charon
->processor
),
197 charon
->processor
->get_total_threads(charon
->processor
));
198 fprintf(out
, " job queue load: %d,",
199 charon
->processor
->get_job_load(charon
->processor
));
200 fprintf(out
, " scheduled events: %d\n",
201 charon
->scheduler
->get_job_load(charon
->scheduler
));
202 iterator
= charon
->kernel_interface
->create_address_iterator(
203 charon
->kernel_interface
);
204 fprintf(out
, "Listening IP addresses:\n");
205 while (iterator
->iterate(iterator
, (void**)&host
))
207 fprintf(out
, " %H\n", host
);
209 iterator
->destroy(iterator
);
211 fprintf(out
, "Connections:\n");
212 enumerator
= charon
->backends
->create_peer_cfg_enumerator(charon
->backends
);
213 while (enumerator
->enumerate(enumerator
, (void**)&peer_cfg
))
215 if (peer_cfg
->get_ike_version(peer_cfg
) != 2 ||
216 (name
&& !streq(name
, peer_cfg
->get_name(peer_cfg
))))
221 ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
222 fprintf(out
, "%12s: %H[%D]...%H[%D]\n", peer_cfg
->get_name(peer_cfg
),
223 ike_cfg
->get_my_host(ike_cfg
), peer_cfg
->get_my_id(peer_cfg
),
224 ike_cfg
->get_other_host(ike_cfg
), peer_cfg
->get_other_id(peer_cfg
));
225 /* TODO: list CAs and groups */
226 children
= peer_cfg
->create_child_cfg_enumerator(peer_cfg
);
227 while (children
->enumerate(children
, &child_cfg
))
229 linked_list_t
*my_ts
, *other_ts
;
230 my_ts
= child_cfg
->get_traffic_selectors(child_cfg
, TRUE
, NULL
, NULL
);
231 other_ts
= child_cfg
->get_traffic_selectors(child_cfg
, FALSE
, NULL
, NULL
);
232 fprintf(out
, "%12s: %#R=== %#R\n", child_cfg
->get_name(child_cfg
),
234 my_ts
->destroy_offset(my_ts
, offsetof(traffic_selector_t
, destroy
));
235 other_ts
->destroy_offset(other_ts
, offsetof(traffic_selector_t
, destroy
));
237 children
->destroy(children
);
239 enumerator
->destroy(enumerator
);
242 iterator
= charon
->ike_sa_manager
->create_iterator(charon
->ike_sa_manager
);
243 if (all
&& iterator
->get_count(iterator
) > 0)
245 fprintf(out
, "Security Associations:\n");
247 while (iterator
->iterate(iterator
, (void**)&ike_sa
))
249 bool ike_printed
= FALSE
;
250 child_sa_t
*child_sa
;
251 iterator_t
*children
= ike_sa
->create_child_sa_iterator(ike_sa
);
253 if (name
== NULL
|| streq(name
, ike_sa
->get_name(ike_sa
)))
255 log_ike_sa(out
, ike_sa
, all
);
259 while (children
->iterate(children
, (void**)&child_sa
))
261 if (name
== NULL
|| streq(name
, child_sa
->get_name(child_sa
)))
265 log_ike_sa(out
, ike_sa
, all
);
268 log_child_sa(out
, child_sa
, all
);
271 children
->destroy(children
);
273 iterator
->destroy(iterator
);
277 * list all X.509 certificates matching the flags
279 static void stroke_list_certs(char *label
, x509_flag_t flags
, bool utc
, FILE *out
)
282 time_t now
= time(NULL
);
284 enumerator_t
*enumerator
;
286 enumerator
= charon
->credentials
->create_cert_enumerator(
287 charon
->credentials
, CERT_X509
, KEY_ANY
, NULL
, FALSE
);
288 while (enumerator
->enumerate(enumerator
, (void**)&cert
))
290 x509_t
*x509
= (x509_t
*)cert
;
291 x509_flag_t x509_flags
= x509
->get_flags(x509
);
293 /* list only if flag is set, or flags == 0 (ignoring self-signed) */
294 if ((x509_flags
& flags
) || (flags
== (x509_flags
& ~X509_SELF_SIGNED
)))
296 enumerator_t
*enumerator
;
297 identification_t
*altName
;
298 bool first_altName
= TRUE
;
299 chunk_t serial
= x509
->get_serial(x509
);
300 identification_t
*authkey
= x509
->get_authKeyIdentifier(x509
);
301 time_t notBefore
, notAfter
;
302 public_key_t
*public = cert
->get_public_key(cert
);
307 fprintf(out
, "List of %s:\n", label
);
312 /* list subjectAltNames */
313 enumerator
= x509
->create_subjectAltName_enumerator(x509
);
314 while (enumerator
->enumerate(enumerator
, (void**)&altName
))
318 fprintf(out
, " altNames: ");
319 first_altName
= FALSE
;
325 fprintf(out
, "%D", altName
);
331 enumerator
->destroy(enumerator
);
333 fprintf(out
, " subject: %D\n", cert
->get_subject(cert
));
334 fprintf(out
, " issuer: %D\n", cert
->get_issuer(cert
));
335 fprintf(out
, " serial: %#B\n", &serial
);
338 cert
->get_validity(cert
, &now
, ¬Before
, ¬After
);
339 fprintf(out
, " validity: not before %#T, ", ¬Before
, utc
);
342 fprintf(out
, "not valid yet (valid in %#V)\n", &now
, ¬Before
);
346 fprintf(out
, "ok\n");
348 fprintf(out
, " not after %#T, ", ¬After
, utc
);
351 fprintf(out
, "expired (%#V ago)\n", &now
, ¬After
);
356 if (now
> notAfter
- CERT_WARNING_INTERVAL
* 60 * 60 * 24)
358 fprintf(out
, " (expires in %#V)", &now
, ¬After
);
363 /* list public key information */
366 private_key_t
*private = NULL
;
367 identification_t
*id
, *keyid
;
369 id
= public->get_id(public, ID_PUBKEY_SHA1
);
370 keyid
= public->get_id(public, ID_PUBKEY_INFO_SHA1
);
372 private = charon
->credentials
->get_private(
374 public->get_type(public), keyid
, NULL
);
375 fprintf(out
, " pubkey: %N %d bits%s\n",
376 key_type_names
, public->get_type(public),
377 public->get_keysize(public) * 8,
378 private ?
", has private key" : "");
379 fprintf(out
, " keyid: %D\n", keyid
);
380 fprintf(out
, " subjkey: %D\n", id
);
382 public->destroy(public);
385 /* list optional authorityKeyIdentifier */
388 fprintf(out
, " authkey: %D\n", authkey
);
392 enumerator
->destroy(enumerator
);
396 * list all X.509 CRLs
398 static void stroke_list_crls(bool utc
, FILE *out
)
401 time_t thisUpdate
, nextUpdate
, now
= time(NULL
);
403 enumerator_t
*enumerator
;
405 enumerator
= charon
->credentials
->create_cert_enumerator(
406 charon
->credentials
, CERT_X509_CRL
, KEY_ANY
, NULL
, FALSE
);
407 while (enumerator
->enumerate(enumerator
, (void**)&cert
))
409 crl_t
*crl
= (crl_t
*)cert
;
410 chunk_t serial
= crl
->get_serial(crl
);
411 identification_t
*authkey
= crl
->get_authKeyIdentifier(crl
);
416 fprintf(out
, "List of X.509 CRLs:\n");
421 fprintf(out
, " issuer: %D\n", cert
->get_issuer(cert
));
423 /* list optional crlNumber */
426 fprintf(out
, " serial: %#B\n", &serial
);
429 /* count the number of revoked certificates */
432 enumerator_t
*enumerator
= crl
->create_enumerator(crl
);
434 while (enumerator
->enumerate(enumerator
, NULL
, NULL
, NULL
))
438 fprintf(out
, " revoked: %d certificate%s\n", count
,
439 (count
== 1)?
"" : "s");
440 enumerator
->destroy(enumerator
);
444 cert
->get_validity(cert
, &now
, &thisUpdate
, &nextUpdate
);
445 fprintf(out
, " updates: this %#T\n", &thisUpdate
, utc
);
446 fprintf(out
, " next %#T, ", &nextUpdate
, utc
);
447 if (now
> nextUpdate
)
449 fprintf(out
, "expired (%#V ago)\n", &now
, &nextUpdate
);
454 if (now
> nextUpdate
- CRL_WARNING_INTERVAL
* 60 * 60 * 24)
456 fprintf(out
, " (expires in %#V)", &now
, &nextUpdate
);
461 /* list optional authorityKeyIdentifier */
464 fprintf(out
, " authkey: %D\n", authkey
);
467 enumerator
->destroy(enumerator
);
471 * Implementation of stroke_list_t.list.
473 static void list(private_stroke_list_t
*this, stroke_msg_t
*msg
, FILE *out
)
475 if (msg
->list
.flags
& LIST_CERTS
)
477 stroke_list_certs("X.509 End Entity Certificates",
478 0, msg
->list
.utc
, out
);
480 if (msg
->list
.flags
& LIST_CACERTS
)
482 stroke_list_certs("X.509 CA Certificates",
483 X509_CA
, msg
->list
.utc
, out
);
485 if (msg
->list
.flags
& LIST_OCSPCERTS
)
487 stroke_list_certs("X.509 OCSP Signer Certificates",
488 X509_OCSP_SIGNER
, msg
->list
.utc
, out
);
490 if (msg
->list
.flags
& LIST_AACERTS
)
492 stroke_list_certs("X.509 AA Certificates",
493 X509_AA
, msg
->list
.utc
, out
);
495 if (msg
->list
.flags
& LIST_ACERTS
)
499 if (msg
->list
.flags
& LIST_CRLS
)
501 stroke_list_crls(msg
->list
.utc
, out
);
503 if (msg
->list
.flags
& LIST_OCSP
)
510 * Implementation of stroke_list_t.destroy
512 static void destroy(private_stroke_list_t
*this)
520 stroke_list_t
*stroke_list_create()
522 private_stroke_list_t
*this = malloc_thing(private_stroke_list_t
);
524 this->public.list
= (void(*)(stroke_list_t
*, stroke_msg_t
*msg
, FILE *out
))list
;
525 this->public.status
= (void(*)(stroke_list_t
*, stroke_msg_t
*msg
, FILE *out
,bool))status
;
526 this->public.destroy
= (void(*)(stroke_list_t
*))destroy
;
528 this->uptime
= time(NULL
);
530 return &this->public;