src/charon/plugins/stroke/stroke_socket.c

   1 /*
   2  * Copyright (C) 2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  *
  15  * $Id$
  16  */
  17
  18 #include "stroke_socket.h"
  19
  20 #include <stdlib.h>
  21 #include <sys/types.h>
  22 #include <sys/stat.h>
  23 #include <sys/socket.h>
  24 #include <sys/un.h>
  25 #include <sys/fcntl.h>
  26 #include <unistd.h>
  27 #include <errno.h>
  28
  29 #include <processing/jobs/callback_job.h>
  30 #include <daemon.h>
  31
  32 #include "stroke_config.h"
  33 #include "stroke_control.h"
  34 #include "stroke_cred.h"
  35 #include "stroke_ca.h"
  36 #include "stroke_attribute.h"
  37 #include "stroke_list.h"
  38
  39 typedef struct stroke_job_context_t stroke_job_context_t;
  40 typedef struct private_stroke_socket_t private_stroke_socket_t;
  41
  42 /**
  43  * private data of stroke_socket
  44  */
  45 struct private_stroke_socket_t {
  46
  47         /**
  48          * public functions
  49          */
  50         stroke_socket_t public;
  51
  52         /**
  53          * Unix socket to listen for strokes
  54          */
  55         int socket;
  56
  57         /**
  58          * job accepting stroke messages
  59          */
  60         callback_job_t *job;
  61
  62         /**
  63          * configuration backend
  64          */
  65         stroke_config_t *config;
  66
  67         /**
  68          * attribute provider
  69          */
  70         stroke_attribute_t *attribute;
  71
  72         /**
  73          * controller to control daemon
  74          */
  75         stroke_control_t *control;
  76
  77         /**
  78          * credential set
  79          */
  80         stroke_cred_t *cred;
  81
  82         /**
  83          * CA sections
  84          */
  85         stroke_ca_t *ca;
  86
  87         /**
  88          * Status information logging
  89          */
  90         stroke_list_t *list;
  91 };
  92
  93 /**
  94  * job context to pass to processing thread
  95  */
  96 struct stroke_job_context_t {
  97
  98         /**
  99          * file descriptor to read from
 100          */
 101         int fd;
 102
 103         /**
 104          * global stroke interface
 105          */
 106         private_stroke_socket_t *this;
 107 };
 108
 109 /**
 110  * Helper function which corrects the string pointers
 111  * in a stroke_msg_t. Strings in a stroke_msg sent over "wire"
 112  * contains RELATIVE addresses (relative to the beginning of the
 113  * stroke_msg). They must be corrected if they reach our address
 114  * space...
 115  */
 116 static void pop_string(stroke_msg_t *msg, char **string)
 117 {
 118         if (*string == NULL)
 119         {
 120                 return;
 121         }
 122
 123         /* check for sanity of string pointer and string */
 124         if (string < (char**)msg ||
 125                 string > (char**)msg + sizeof(stroke_msg_t) ||
 126                 (unsigned long)*string < (unsigned long)((char*)msg->buffer - (char*)msg) ||
 127                 (unsigned long)*string > msg->length)
 128         {
 129                 *string = "(invalid pointer in stroke msg)";
 130         }
 131         else
 132         {
 133                 *string = (char*)msg + (unsigned long)*string;
 134         }
 135 }
 136
 137 /**
 138  * Pop the strings of a stroke_end_t struct and log them for debugging purposes
 139  */
 140 static void pop_end(stroke_msg_t *msg, const char* label, stroke_end_t *end)
 141 {
 142         pop_string(msg, &end->address);
 143         pop_string(msg, &end->subnet);
 144         pop_string(msg, &end->sourceip);
 145         pop_string(msg, &end->id);
 146         pop_string(msg, &end->cert);
 147         pop_string(msg, &end->ca);
 148         pop_string(msg, &end->groups);
 149         pop_string(msg, &end->updown);
 150
 151         DBG2(DBG_CFG, "  %s=%s", label, end->address);
 152         DBG2(DBG_CFG, "  %ssubnet=%s", label, end->subnet);
 153         DBG2(DBG_CFG, "  %ssourceip=%s", label, end->sourceip);
 154         DBG2(DBG_CFG, "  %sid=%s", label, end->id);
 155         DBG2(DBG_CFG, "  %scert=%s", label, end->cert);
 156         DBG2(DBG_CFG, "  %sca=%s", label, end->ca);
 157         DBG2(DBG_CFG, "  %sgroups=%s", label, end->groups);
 158         DBG2(DBG_CFG, "  %supdown=%s", label, end->updown);
 159 }
 160
 161 /**
 162  * Add a connection to the configuration list
 163  */
 164 static void stroke_add_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
 165 {
 166         pop_string(msg, &msg->add_conn.name);
 167         DBG1(DBG_CFG, "received stroke: add connection '%s'", msg->add_conn.name);
 168         DBG2(DBG_CFG, "conn %s", msg->add_conn.name);
 169         pop_end(msg, "left", &msg->add_conn.me);
 170         pop_end(msg, "right", &msg->add_conn.other);
 171         pop_string(msg, &msg->add_conn.algorithms.ike);
 172         pop_string(msg, &msg->add_conn.algorithms.esp);
 173         DBG2(DBG_CFG, "  ike=%s", msg->add_conn.algorithms.ike);
 174         DBG2(DBG_CFG, "  esp=%s", msg->add_conn.algorithms.esp);
 175         pop_string(msg, &msg->add_conn.ikeme.mediated_by);
 176         pop_string(msg, &msg->add_conn.ikeme.peerid);
 177         DBG2(DBG_CFG, "  mediation=%s", msg->add_conn.ikeme.mediation ? "yes" : "no");
 178         DBG2(DBG_CFG, "  mediated_by=%s", msg->add_conn.ikeme.mediated_by);
 179         DBG2(DBG_CFG, "  me_peerid=%s", msg->add_conn.ikeme.peerid);
 180
 181         this->config->add(this->config, msg);
 182         this->attribute->add_pool(this->attribute, msg);
 183 }
 184
 185 /**
 186  * Delete a connection from the list
 187  */
 188 static void stroke_del_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
 189 {
 190         pop_string(msg, &msg->del_conn.name);
 191         DBG1(DBG_CFG, "received stroke: delete connection '%s'", msg->del_conn.name);
 192
 193         this->config->del(this->config, msg);
 194         this->attribute->del_pool(this->attribute, msg);
 195 }
 196
 197 /**
 198  * initiate a connection by name
 199  */
 200 static void stroke_initiate(private_stroke_socket_t *this, stroke_msg_t *msg, FILE *out)
 201 {
 202         pop_string(msg, &msg->initiate.name);
 203         DBG1(DBG_CFG, "received stroke: initiate '%s'", msg->initiate.name);
 204
 205         this->control->initiate(this->control, msg, out);
 206 }
 207
 208 /**
 209  * terminate a connection by name
 210  */
 211 static void stroke_terminate(private_stroke_socket_t *this, stroke_msg_t *msg, FILE *out)
 212 {
 213         pop_string(msg, &msg->terminate.name);
 214         DBG1(DBG_CFG, "received stroke: terminate '%s'", msg->terminate.name);
 215
 216         this->control->terminate(this->control, msg, out);
 217 }
 218
 219 /**
 220  * route a policy (install SPD entries)
 221  */
 222 static void stroke_route(private_stroke_socket_t *this, stroke_msg_t *msg, FILE *out)
 223 {
 224         pop_string(msg, &msg->route.name);
 225         DBG1(DBG_CFG, "received stroke: route '%s'", msg->route.name);
 226
 227         this->control->route(this->control, msg, out);
 228 }
 229
 230 /**
 231  * unroute a policy
 232  */
 233 static void stroke_unroute(private_stroke_socket_t *this, stroke_msg_t *msg, FILE *out)
 234 {
 235         pop_string(msg, &msg->terminate.name);
 236         DBG1(DBG_CFG, "received stroke: unroute '%s'", msg->route.name);
 237
 238         this->control->unroute(this->control, msg, out);
 239 }
 240
 241 /**
 242  * Add a ca information record to the cainfo list
 243  */
 244 static void stroke_add_ca(private_stroke_socket_t *this,
 245                                                   stroke_msg_t *msg, FILE *out)
 246 {
 247         pop_string(msg, &msg->add_ca.name);
 248         pop_string(msg, &msg->add_ca.cacert);
 249         pop_string(msg, &msg->add_ca.crluri);
 250         pop_string(msg, &msg->add_ca.crluri2);
 251         pop_string(msg, &msg->add_ca.ocspuri);
 252         pop_string(msg, &msg->add_ca.ocspuri2);
 253
 254         DBG2(DBG_CFG, "ca %s",        msg->add_ca.name);
 255         DBG2(DBG_CFG, "  cacert=%s",  msg->add_ca.cacert);
 256         DBG2(DBG_CFG, "  crluri=%s",  msg->add_ca.crluri);
 257         DBG2(DBG_CFG, "  crluri2=%s", msg->add_ca.crluri2);
 258         DBG2(DBG_CFG, "  ocspuri=%s", msg->add_ca.ocspuri);
 259         DBG2(DBG_CFG, "  ocspuri2=%s", msg->add_ca.ocspuri2);
 260
 261         DBG1(DBG_CFG, "received stroke: add ca '%s'", msg->add_ca.name);
 262
 263         this->ca->add(this->ca, msg);
 264 }
 265
 266 /**
 267  * Delete a ca information record from the cainfo list
 268  */
 269 static void stroke_del_ca(private_stroke_socket_t *this,
 270                                                   stroke_msg_t *msg, FILE *out)
 271 {
 272         pop_string(msg, &msg->del_ca.name);
 273         DBG1(DBG_CFG, "received stroke: delete ca '%s'", msg->del_ca.name);
 274
 275         this->ca->del(this->ca, msg);
 276 }
 277
 278
 279 /**
 280  * show status of daemon
 281  */
 282 static void stroke_status(private_stroke_socket_t *this,
 283                                                   stroke_msg_t *msg, FILE *out, bool all)
 284 {
 285         pop_string(msg, &(msg->status.name));
 286
 287         this->list->status(this->list, msg, out, all);
 288 }
 289
 290 /**
 291  * list various information
 292  */
 293 static void stroke_list(private_stroke_socket_t *this, stroke_msg_t *msg, FILE *out)
 294 {
 295         if (msg->list.flags & LIST_CAINFOS)
 296         {
 297                 this->ca->list(this->ca, msg, out);
 298         }
 299         this->list->list(this->list, msg, out);
 300 }
 301
 302 /**
 303  * reread various information
 304  */
 305 static void stroke_reread(private_stroke_socket_t *this,
 306                                                   stroke_msg_t *msg, FILE *out)
 307 {
 308         this->cred->reread(this->cred, msg);
 309 }
 310
 311 /**
 312  * purge various information
 313  */
 314 static void stroke_purge(private_stroke_socket_t *this,
 315                                                  stroke_msg_t *msg, FILE *out)
 316 {
 317         charon->credentials->flush_cache(charon->credentials,
 318                                                                          CERT_X509_OCSP_RESPONSE);
 319 }
 320
 321 signal_t get_signal_from_logtype(char *type)
 322 {
 323         if      (strcasecmp(type, "any") == 0) return SIG_ANY;
 324         else if (strcasecmp(type, "mgr") == 0) return DBG_MGR;
 325         else if (strcasecmp(type, "ike") == 0) return DBG_IKE;
 326         else if (strcasecmp(type, "chd") == 0) return DBG_CHD;
 327         else if (strcasecmp(type, "job") == 0) return DBG_JOB;
 328         else if (strcasecmp(type, "cfg") == 0) return DBG_CFG;
 329         else if (strcasecmp(type, "knl") == 0) return DBG_KNL;
 330         else if (strcasecmp(type, "net") == 0) return DBG_NET;
 331         else if (strcasecmp(type, "enc") == 0) return DBG_ENC;
 332         else if (strcasecmp(type, "lib") == 0) return DBG_LIB;
 333         else return -1;
 334 }
 335
 336 /**
 337  * set the verbosity debug output
 338  */
 339 static void stroke_loglevel(private_stroke_socket_t *this, stroke_msg_t *msg, FILE *out)
 340 {
 341         signal_t signal;
 342
 343         pop_string(msg, &(msg->loglevel.type));
 344         DBG1(DBG_CFG, "received stroke: loglevel %d for %s",
 345                  msg->loglevel.level, msg->loglevel.type);
 346
 347         signal = get_signal_from_logtype(msg->loglevel.type);
 348         if (signal < 0)
 349         {
 350                 fprintf(out, "invalid type (%s)!\n", msg->loglevel.type);
 351                 return;
 352         }
 353
 354         charon->outlog->set_level(charon->outlog, signal, msg->loglevel.level);
 355         charon->syslog->set_level(charon->syslog, signal, msg->loglevel.level);
 356 }
 357
 358 /**
 359  * set various config options
 360  */
 361 static void stroke_config(private_stroke_socket_t *this, stroke_msg_t *msg, FILE *out)
 362 {
 363         this->cred->cachecrl(this->cred, msg->config.cachecrl);
 364 }
 365
 366 /**
 367  * destroy a job context
 368  */
 369 static void stroke_job_context_destroy(stroke_job_context_t *this)
 370 {
 371         close(this->fd);
 372         free(this);
 373 }
 374
 375 /**
 376  * process a stroke request from the socket pointed by "fd"
 377  */
 378 static job_requeue_t process(stroke_job_context_t *ctx)
 379 {
 380         stroke_msg_t *msg;
 381         u_int16_t msg_length;
 382         ssize_t bytes_read;
 383         FILE *out;
 384         private_stroke_socket_t *this = ctx->this;
 385         int strokefd = ctx->fd;
 386
 387         /* peek the length */
 388         bytes_read = recv(strokefd, &msg_length, sizeof(msg_length), MSG_PEEK);
 389         if (bytes_read != sizeof(msg_length))
 390         {
 391                 DBG1(DBG_CFG, "reading length of stroke message failed: %s",
 392                          strerror(errno));
 393                 close(strokefd);
 394                 return JOB_REQUEUE_NONE;
 395         }
 396
 397         /* read message */
 398         msg = malloc(msg_length);
 399         bytes_read = recv(strokefd, msg, msg_length, 0);
 400         if (bytes_read != msg_length)
 401         {
 402                 DBG1(DBG_CFG, "reading stroke message failed: %s", strerror(errno));
 403                 close(strokefd);
 404                 return JOB_REQUEUE_NONE;
 405         }
 406
 407         out = fdopen(strokefd, "w");
 408         if (out == NULL)
 409         {
 410                 DBG1(DBG_CFG, "opening stroke output channel failed: %s", strerror(errno));
 411                 close(strokefd);
 412                 free(msg);
 413                 return JOB_REQUEUE_NONE;
 414         }
 415
 416         DBG3(DBG_CFG, "stroke message %b", (void*)msg, msg_length);
 417
 418         /* the stroke_* functions are blocking, as they listen on the bus. Add
 419          * cancellation handlers. */
 420         pthread_cleanup_push((void*)fclose, out);
 421         pthread_cleanup_push(free, msg);
 422
 423         switch (msg->type)
 424         {
 425                 case STR_INITIATE:
 426                         stroke_initiate(this, msg, out);
 427                         break;
 428                 case STR_ROUTE:
 429                         stroke_route(this, msg, out);
 430                         break;
 431                 case STR_UNROUTE:
 432                         stroke_unroute(this, msg, out);
 433                         break;
 434                 case STR_TERMINATE:
 435                         stroke_terminate(this, msg, out);
 436                         break;
 437                 case STR_STATUS:
 438                         stroke_status(this, msg, out, FALSE);
 439                         break;
 440                 case STR_STATUS_ALL:
 441                         stroke_status(this, msg, out, TRUE);
 442                         break;
 443                 case STR_ADD_CONN:
 444                         stroke_add_conn(this, msg);
 445                         break;
 446                 case STR_DEL_CONN:
 447                         stroke_del_conn(this, msg);
 448                         break;
 449                 case STR_ADD_CA:
 450                         stroke_add_ca(this, msg, out);
 451                         break;
 452                 case STR_DEL_CA:
 453                         stroke_del_ca(this, msg, out);
 454                         break;
 455                 case STR_LOGLEVEL:
 456                         stroke_loglevel(this, msg, out);
 457                         break;
 458                 case STR_CONFIG:
 459                         stroke_config(this, msg, out);
 460                         break;
 461                 case STR_LIST:
 462                         stroke_list(this, msg, out);
 463                         break;
 464                 case STR_REREAD:
 465                         stroke_reread(this, msg, out);
 466                         break;
 467                 case STR_PURGE:
 468                         stroke_purge(this, msg, out);
 469                         break;
 470                 default:
 471                         DBG1(DBG_CFG, "received unknown stroke");
 472         }
 473         /* remove and execute cancellation handlers */
 474         pthread_cleanup_pop(1);
 475         pthread_cleanup_pop(1);
 476
 477         return JOB_REQUEUE_NONE;
 478 }
 479
 480 /**
 481  * Implementation of private_stroke_socket_t.stroke_receive.
 482  */
 483 static job_requeue_t receive(private_stroke_socket_t *this)
 484 {
 485         struct sockaddr_un strokeaddr;
 486         int strokeaddrlen = sizeof(strokeaddr);
 487         int strokefd;
 488         int oldstate;
 489         callback_job_t *job;
 490         stroke_job_context_t *ctx;
 491
 492         pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
 493         strokefd = accept(this->socket, (struct sockaddr *)&strokeaddr, &strokeaddrlen);
 494         pthread_setcancelstate(oldstate, NULL);
 495
 496         if (strokefd < 0)
 497         {
 498                 DBG1(DBG_CFG, "accepting stroke connection failed: %s", strerror(errno));
 499                 return JOB_REQUEUE_FAIR;
 500         }
 501
 502         ctx = malloc_thing(stroke_job_context_t);
 503         ctx->fd = strokefd;
 504         ctx->this = this;
 505         job = callback_job_create((callback_job_cb_t)process,
 506                                                           ctx, (void*)stroke_job_context_destroy, this->job);
 507         charon->processor->queue_job(charon->processor, (job_t*)job);
 508
 509         return JOB_REQUEUE_FAIR;
 510 }
 511
 512
 513 /**
 514  * initialize and open stroke socket
 515  */
 516 static bool open_socket(private_stroke_socket_t *this)
 517 {
 518         struct sockaddr_un socket_addr = { AF_UNIX, STROKE_SOCKET};
 519         mode_t old;
 520
 521         /* set up unix socket */
 522         this->socket = socket(AF_UNIX, SOCK_STREAM, 0);
 523         if (this->socket == -1)
 524         {
 525                 DBG1(DBG_CFG, "could not create stroke socket");
 526                 return FALSE;
 527         }
 528
 529         unlink(socket_addr.sun_path);
 530         old = umask(~(S_IRWXU | S_IRWXG));
 531         if (bind(this->socket, (struct sockaddr *)&socket_addr, sizeof(socket_addr)) < 0)
 532         {
 533                 DBG1(DBG_CFG, "could not bind stroke socket: %s", strerror(errno));
 534                 close(this->socket);
 535                 return FALSE;
 536         }
 537         umask(old);
 538         if (chown(socket_addr.sun_path, IPSEC_UID, IPSEC_GID) != 0)
 539         {
 540                 DBG1(DBG_CFG, "changing stroke socket permissions failed: %s",
 541                          strerror(errno));
 542         }
 543
 544         if (listen(this->socket, 0) < 0)
 545         {
 546                 DBG1(DBG_CFG, "could not listen on stroke socket: %s", strerror(errno));
 547                 close(this->socket);
 548                 unlink(socket_addr.sun_path);
 549                 return FALSE;
 550         }
 551         return TRUE;
 552 }
 553
 554 /**
 555  * Implementation of stroke_socket_t.destroy
 556  */
 557 static void destroy(private_stroke_socket_t *this)
 558 {
 559         this->job->cancel(this->job);
 560         charon->credentials->remove_set(charon->credentials, &this->ca->set);
 561         charon->credentials->remove_set(charon->credentials, &this->cred->set);
 562         charon->backends->remove_backend(charon->backends, &this->config->backend);
 563         charon->attributes->remove_provider(charon->attributes, &this->attribute->provider);
 564         this->cred->destroy(this->cred);
 565         this->ca->destroy(this->ca);
 566         this->config->destroy(this->config);
 567         this->attribute->destroy(this->attribute);
 568         this->control->destroy(this->control);
 569         this->list->destroy(this->list);
 570         free(this);
 571 }
 572
 573 /*
 574  * see header file
 575  */
 576 stroke_socket_t *stroke_socket_create()
 577 {
 578         private_stroke_socket_t *this = malloc_thing(private_stroke_socket_t);
 579
 580         this->public.destroy = (void(*)(stroke_socket_t*))destroy;
 581
 582         if (!open_socket(this))
 583         {
 584                 free(this);
 585                 return NULL;
 586         }
 587
 588         this->cred = stroke_cred_create();
 589         this->attribute = stroke_attribute_create();
 590         this->ca = stroke_ca_create(this->cred);
 591         this->config = stroke_config_create(this->cred);
 592         this->control = stroke_control_create();
 593         this->list = stroke_list_create();
 594
 595         charon->credentials->add_set(charon->credentials, &this->ca->set);
 596         charon->credentials->add_set(charon->credentials, &this->cred->set);
 597         charon->backends->add_backend(charon->backends, &this->config->backend);
 598         charon->attributes->add_provider(charon->attributes, &this->attribute->provider);
 599
 600         this->job = callback_job_create((callback_job_cb_t)receive,
 601                                                                         this, NULL, NULL);
 602         charon->processor->queue_job(charon->processor, (job_t*)this->job);
 603
 604         return &this->public;
 605 }
 606