2 * Copyright (C) 2015-2017 Tobias Brunner
3 * Copyright (C) 2015-2018 Andreas Steffen
4 * HSR Hochschule fuer Technik Rapperswil
6 * Copyright (C) 2014 Martin Willi
7 * Copyright (C) 2014 revosec AG
9 * This program is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by the
11 * Free Software Foundation; either version 2 of the License, or (at your
12 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
14 * This program is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
16 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
23 * Permission is hereby granted, free of charge, to any person obtaining a copy
24 * of this software and associated documentation files (the "Software"), to deal
25 * in the Software without restriction, including without limitation the rights
26 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
27 * copies of the Software, and to permit persons to whom the Software is
28 * furnished to do so, subject to the following conditions:
30 * The above copyright notice and this permission notice shall be included in
31 * all copies or substantial portions of the Software.
33 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
34 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
35 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
36 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
37 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
38 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
42 #include "vici_query.h"
43 #include "vici_builder.h"
44 #include "vici_cert_info.h"
49 #include <sys/utsname.h>
56 #include <asn1/asn1.h>
57 #include <credentials/certificates/certificate.h>
58 #include <credentials/certificates/x509.h>
59 #include <counters_query.h>
61 ENUM(vici_counter_type_names
,
62 COUNTER_INIT_IKE_SA_REKEY
, COUNTER_OUT_INFORMATIONAL_RSP
,
76 "create-child-in-req",
77 "create-child-in-resp",
78 "create-child-out-req",
79 "create-child-out-resp",
86 typedef struct private_vici_query_t private_vici_query_t
;
89 * Private data of an vici_query_t object.
91 struct private_vici_query_t
{
94 * Public vici_query_t interface.
101 vici_dispatcher_t
*dispatcher
;
104 * Query interface for counters
106 counters_query_t
*counters
;
109 * Daemon startup timestamp
115 * Add the given mark/mask to the message using the provided labels
117 static void add_mark(vici_builder_t
*b
, mark_t mark
,
118 char *label
, char *mask_label
)
120 if (mark
.value
| mark
.mask
)
122 b
->add_kv(b
, label
, "%.8x", mark
.value
);
125 b
->add_kv(b
, mask_label
, "%.8x", mark
.mask
);
131 * List the mode of a CHILD_SA or config
133 static void list_mode(vici_builder_t
*b
, child_sa_t
*child
, child_cfg_t
*cfg
)
142 cfg
= child
->get_config(child
);
144 mode
= child ? child
->get_mode(child
) : cfg
->get_mode(cfg
);
145 if (mode
== MODE_TRANSPORT
&& cfg
->has_option(cfg
, OPT_PROXY_MODE
))
146 { /* only report this if the negotiated mode is actually TRANSPORT */
149 b
->add_kv(b
, "mode", "%N%s", ipsec_mode_names
, mode
, sub_mode
);
154 * List IPsec-related details about a CHILD_SA
156 static void list_child_ipsec(vici_builder_t
*b
, child_sa_t
*child
)
158 proposal_t
*proposal
;
162 b
->add_kv(b
, "protocol", "%N", protocol_id_names
,
163 child
->get_protocol(child
));
164 if (child
->has_encap(child
))
166 b
->add_kv(b
, "encap", "yes");
168 b
->add_kv(b
, "spi-in", "%.8x", ntohl(child
->get_spi(child
, TRUE
)));
169 b
->add_kv(b
, "spi-out", "%.8x", ntohl(child
->get_spi(child
, FALSE
)));
171 if (child
->get_ipcomp(child
) != IPCOMP_NONE
)
173 b
->add_kv(b
, "cpi-in", "%.4x", ntohs(child
->get_cpi(child
, TRUE
)));
174 b
->add_kv(b
, "cpi-out", "%.4x", ntohs(child
->get_cpi(child
, FALSE
)));
176 add_mark(b
, child
->get_mark(child
, TRUE
), "mark-in", "mark-mask-in");
177 add_mark(b
, child
->get_mark(child
, FALSE
), "mark-out", "mark-mask-out");
179 if_id
= child
->get_if_id(child
, TRUE
);
182 b
->add_kv(b
, "if-id-in", "%.8x", if_id
);
184 if_id
= child
->get_if_id(child
, FALSE
);
187 b
->add_kv(b
, "if-id-out", "%.8x", if_id
);
190 proposal
= child
->get_proposal(child
);
193 if (proposal
->get_algorithm(proposal
, ENCRYPTION_ALGORITHM
,
194 &alg
, &ks
) && alg
!= ENCR_UNDEFINED
)
196 b
->add_kv(b
, "encr-alg", "%N", encryption_algorithm_names
, alg
);
199 b
->add_kv(b
, "encr-keysize", "%u", ks
);
202 if (proposal
->get_algorithm(proposal
, INTEGRITY_ALGORITHM
,
203 &alg
, &ks
) && alg
!= AUTH_UNDEFINED
)
205 b
->add_kv(b
, "integ-alg", "%N", integrity_algorithm_names
, alg
);
208 b
->add_kv(b
, "integ-keysize", "%u", ks
);
211 if (proposal
->get_algorithm(proposal
, DIFFIE_HELLMAN_GROUP
,
214 b
->add_kv(b
, "dh-group", "%N", diffie_hellman_group_names
, alg
);
216 if (proposal
->get_algorithm(proposal
, EXTENDED_SEQUENCE_NUMBERS
,
217 &alg
, NULL
) && alg
== EXT_SEQ_NUMBERS
)
219 b
->add_kv(b
, "esn", "1");
225 * List usage and lifetime stats of a CHILD_SA
227 static void list_child_stats(vici_builder_t
*b
, child_sa_t
*child
, time_t now
)
229 uint64_t bytes
, packets
;
232 child
->get_usestats(child
, TRUE
, &t
, &bytes
, &packets
);
233 b
->add_kv(b
, "bytes-in", "%" PRIu64
, bytes
);
234 b
->add_kv(b
, "packets-in", "%" PRIu64
, packets
);
237 b
->add_kv(b
, "use-in", "%"PRIu64
, (uint64_t)(now
- t
));
240 child
->get_usestats(child
, FALSE
, &t
, &bytes
, &packets
);
241 b
->add_kv(b
, "bytes-out", "%"PRIu64
, bytes
);
242 b
->add_kv(b
, "packets-out", "%"PRIu64
, packets
);
245 b
->add_kv(b
, "use-out", "%"PRIu64
, (uint64_t)(now
- t
));
248 t
= child
->get_lifetime(child
, FALSE
);
251 b
->add_kv(b
, "rekey-time", "%"PRId64
, (int64_t)(t
- now
));
253 t
= child
->get_lifetime(child
, TRUE
);
256 b
->add_kv(b
, "life-time", "%"PRId64
, (int64_t)(t
- now
));
258 t
= child
->get_installtime(child
);
259 b
->add_kv(b
, "install-time", "%"PRId64
, (int64_t)(now
- t
));
263 * List details of a CHILD_SA
265 static void list_child(private_vici_query_t
*this, vici_builder_t
*b
,
266 child_sa_t
*child
, time_t now
)
268 enumerator_t
*enumerator
;
269 traffic_selector_t
*ts
;
270 child_sa_state_t state
;
272 b
->add_kv(b
, "name", "%s", child
->get_name(child
));
273 b
->add_kv(b
, "uniqueid", "%u", child
->get_unique_id(child
));
274 b
->add_kv(b
, "reqid", "%u", child
->get_reqid(child
));
275 state
= child
->get_state(child
);
276 b
->add_kv(b
, "state", "%N", child_sa_state_names
, state
);
277 list_mode(b
, child
, NULL
);
281 case CHILD_INSTALLED
:
286 list_child_ipsec(b
, child
);
287 list_child_stats(b
, child
, now
);
293 b
->begin_list(b
, "local-ts");
294 enumerator
= child
->create_ts_enumerator(child
, TRUE
);
295 while (enumerator
->enumerate(enumerator
, &ts
))
297 b
->add_li(b
, "%R", ts
);
299 enumerator
->destroy(enumerator
);
300 b
->end_list(b
/* local-ts */);
302 b
->begin_list(b
, "remote-ts");
303 enumerator
= child
->create_ts_enumerator(child
, FALSE
);
304 while (enumerator
->enumerate(enumerator
, &ts
))
306 b
->add_li(b
, "%R", ts
);
308 enumerator
->destroy(enumerator
);
309 b
->end_list(b
/* remote-ts */);
313 * List tasks in a specific queue
315 static void list_task_queue(private_vici_query_t
*this, vici_builder_t
*b
,
316 ike_sa_t
*ike_sa
, task_queue_t q
, char *name
)
318 enumerator_t
*enumerator
;
322 enumerator
= ike_sa
->create_task_enumerator(ike_sa
, q
);
323 while (enumerator
->enumerate(enumerator
, &task
))
327 b
->begin_list(b
, name
);
330 b
->add_li(b
, "%N", task_type_names
, task
->get_type(task
));
332 enumerator
->destroy(enumerator
);
340 * Add an IKE_SA condition to the given builder
342 static void add_condition(vici_builder_t
*b
, ike_sa_t
*ike_sa
,
343 char *key
, ike_condition_t cond
)
345 if (ike_sa
->has_condition(ike_sa
, cond
))
347 b
->add_kv(b
, key
, "yes");
354 static void list_vips(private_vici_query_t
*this, vici_builder_t
*b
,
355 ike_sa_t
*ike_sa
, bool local
, char *name
)
357 enumerator_t
*enumerator
;
361 enumerator
= ike_sa
->create_virtual_ip_enumerator(ike_sa
, local
);
362 while (enumerator
->enumerate(enumerator
, &vip
))
366 b
->begin_list(b
, name
);
369 b
->add_li(b
, "%H", vip
);
371 enumerator
->destroy(enumerator
);
379 * List details of an IKE_SA
381 static void list_ike(private_vici_query_t
*this, vici_builder_t
*b
,
382 ike_sa_t
*ike_sa
, time_t now
)
386 identification_t
*eap
;
387 proposal_t
*proposal
;
392 b
->add_kv(b
, "uniqueid", "%u", ike_sa
->get_unique_id(ike_sa
));
393 b
->add_kv(b
, "version", "%u", ike_sa
->get_version(ike_sa
));
394 b
->add_kv(b
, "state", "%N", ike_sa_state_names
, ike_sa
->get_state(ike_sa
));
396 host
= ike_sa
->get_my_host(ike_sa
);
397 b
->add_kv(b
, "local-host", "%H", host
);
398 b
->add_kv(b
, "local-port", "%d", host
->get_port(host
));
399 b
->add_kv(b
, "local-id", "%Y", ike_sa
->get_my_id(ike_sa
));
401 host
= ike_sa
->get_other_host(ike_sa
);
402 b
->add_kv(b
, "remote-host", "%H", host
);
403 b
->add_kv(b
, "remote-port", "%d", host
->get_port(host
));
404 b
->add_kv(b
, "remote-id", "%Y", ike_sa
->get_other_id(ike_sa
));
406 eap
= ike_sa
->get_other_eap_id(ike_sa
);
408 if (!eap
->equals(eap
, ike_sa
->get_other_id(ike_sa
)))
410 if (ike_sa
->get_version(ike_sa
) == IKEV1
)
412 b
->add_kv(b
, "remote-xauth-id", "%Y", eap
);
416 b
->add_kv(b
, "remote-eap-id", "%Y", eap
);
420 id
= ike_sa
->get_id(ike_sa
);
421 if (id
->is_initiator(id
))
423 b
->add_kv(b
, "initiator", "yes");
425 b
->add_kv(b
, "initiator-spi", "%.16"PRIx64
,
426 be64toh(id
->get_initiator_spi(id
)));
427 b
->add_kv(b
, "responder-spi", "%.16"PRIx64
,
428 be64toh(id
->get_responder_spi(id
)));
430 add_condition(b
, ike_sa
, "nat-local", COND_NAT_HERE
);
431 add_condition(b
, ike_sa
, "nat-remote", COND_NAT_THERE
);
432 add_condition(b
, ike_sa
, "nat-fake", COND_NAT_FAKE
);
433 add_condition(b
, ike_sa
, "nat-any", COND_NAT_ANY
);
435 if_id
= ike_sa
->get_if_id(ike_sa
, TRUE
);
438 b
->add_kv(b
, "if-id-in", "%.8x", if_id
);
440 if_id
= ike_sa
->get_if_id(ike_sa
, FALSE
);
443 b
->add_kv(b
, "if-id-out", "%.8x", if_id
);
446 proposal
= ike_sa
->get_proposal(ike_sa
);
449 if (proposal
->get_algorithm(proposal
, ENCRYPTION_ALGORITHM
, &alg
, &ks
))
451 b
->add_kv(b
, "encr-alg", "%N", encryption_algorithm_names
, alg
);
454 b
->add_kv(b
, "encr-keysize", "%u", ks
);
457 if (proposal
->get_algorithm(proposal
, INTEGRITY_ALGORITHM
, &alg
, &ks
))
459 b
->add_kv(b
, "integ-alg", "%N", integrity_algorithm_names
, alg
);
462 b
->add_kv(b
, "integ-keysize", "%u", ks
);
465 if (proposal
->get_algorithm(proposal
, PSEUDO_RANDOM_FUNCTION
, &alg
, NULL
))
467 b
->add_kv(b
, "prf-alg", "%N", pseudo_random_function_names
, alg
);
469 if (proposal
->get_algorithm(proposal
, DIFFIE_HELLMAN_GROUP
, &alg
, NULL
))
471 b
->add_kv(b
, "dh-group", "%N", diffie_hellman_group_names
, alg
);
474 add_condition(b
, ike_sa
, "ppk", COND_PPK
);
476 if (ike_sa
->get_state(ike_sa
) == IKE_ESTABLISHED
)
478 t
= ike_sa
->get_statistic(ike_sa
, STAT_ESTABLISHED
);
479 b
->add_kv(b
, "established", "%"PRId64
, (int64_t)(now
- t
));
480 t
= ike_sa
->get_statistic(ike_sa
, STAT_REKEY
);
483 b
->add_kv(b
, "rekey-time", "%"PRId64
, (int64_t)(t
- now
));
485 t
= ike_sa
->get_statistic(ike_sa
, STAT_REAUTH
);
488 b
->add_kv(b
, "reauth-time", "%"PRId64
, (int64_t)(t
- now
));
492 list_vips(this, b
, ike_sa
, TRUE
, "local-vips");
493 list_vips(this, b
, ike_sa
, FALSE
, "remote-vips");
495 list_task_queue(this, b
, ike_sa
, TASK_QUEUE_QUEUED
, "tasks-queued");
496 list_task_queue(this, b
, ike_sa
, TASK_QUEUE_ACTIVE
, "tasks-active");
497 list_task_queue(this, b
, ike_sa
, TASK_QUEUE_PASSIVE
, "tasks-passive");
500 CALLBACK(list_sas
, vici_message_t
*,
501 private_vici_query_t
*this, char *name
, u_int id
, vici_message_t
*request
)
504 enumerator_t
*isas
, *csas
;
506 child_sa_t
*child_sa
;
513 bl
= request
->get_str(request
, NULL
, "noblock") == NULL
;
514 ike
= request
->get_str(request
, NULL
, "ike");
515 ike_id
= request
->get_int(request
, 0, "ike-id");
517 isas
= charon
->controller
->create_ike_sa_enumerator(charon
->controller
, bl
);
518 while (isas
->enumerate(isas
, &ike_sa
))
520 if (ike
&& !streq(ike
, ike_sa
->get_name(ike_sa
)))
524 if (ike_id
&& ike_id
!= ike_sa
->get_unique_id(ike_sa
))
529 now
= time_monotonic(NULL
);
531 b
= vici_builder_create();
532 b
->begin_section(b
, ike_sa
->get_name(ike_sa
));
534 list_ike(this, b
, ike_sa
, now
);
536 b
->begin_section(b
, "child-sas");
537 csas
= ike_sa
->create_child_sa_enumerator(ike_sa
);
538 while (csas
->enumerate(csas
, &child_sa
))
540 snprintf(buf
, sizeof(buf
), "%s-%u", child_sa
->get_name(child_sa
),
541 child_sa
->get_unique_id(child_sa
));
542 b
->begin_section(b
, buf
);
543 list_child(this, b
, child_sa
, now
);
547 b
->end_section(b
/* child-sas */ );
551 this->dispatcher
->raise_event(this->dispatcher
, "list-sa", id
,
556 b
= vici_builder_create();
557 return b
->finalize(b
);
561 * Raise a list-policy event for given CHILD_SA
563 static void raise_policy(private_vici_query_t
*this, u_int id
, char *ike
,
566 enumerator_t
*enumerator
;
567 traffic_selector_t
*ts
;
571 b
= vici_builder_create();
572 snprintf(buf
, sizeof(buf
), "%s/%s", ike
, child
->get_name(child
));
573 b
->begin_section(b
, buf
);
574 b
->add_kv(b
, "child", "%s", child
->get_name(child
));
575 b
->add_kv(b
, "ike", "%s", ike
);
577 list_mode(b
, child
, NULL
);
579 b
->begin_list(b
, "local-ts");
580 enumerator
= child
->create_ts_enumerator(child
, TRUE
);
581 while (enumerator
->enumerate(enumerator
, &ts
))
583 b
->add_li(b
, "%R", ts
);
585 enumerator
->destroy(enumerator
);
586 b
->end_list(b
/* local-ts */);
588 b
->begin_list(b
, "remote-ts");
589 enumerator
= child
->create_ts_enumerator(child
, FALSE
);
590 while (enumerator
->enumerate(enumerator
, &ts
))
592 b
->add_li(b
, "%R", ts
);
594 enumerator
->destroy(enumerator
);
595 b
->end_list(b
/* remote-ts */);
599 this->dispatcher
->raise_event(this->dispatcher
, "list-policy", id
,
604 * Raise a list-policy event for given CHILD_SA config
606 static void raise_policy_cfg(private_vici_query_t
*this, u_int id
, char *ike
,
609 enumerator_t
*enumerator
;
611 traffic_selector_t
*ts
;
615 b
= vici_builder_create();
616 snprintf(buf
, sizeof(buf
), "%s%s%s", ike ? ike
: "", ike ?
"/" : "",
618 b
->begin_section(b
, buf
);
619 b
->add_kv(b
, "child", "%s", cfg
->get_name(cfg
));
622 b
->add_kv(b
, "ike", "%s", ike
);
625 list_mode(b
, NULL
, cfg
);
627 b
->begin_list(b
, "local-ts");
628 list
= cfg
->get_traffic_selectors(cfg
, TRUE
, NULL
, NULL
, FALSE
);
629 enumerator
= list
->create_enumerator(list
);
630 while (enumerator
->enumerate(enumerator
, &ts
))
632 b
->add_li(b
, "%R", ts
);
634 enumerator
->destroy(enumerator
);
635 list
->destroy_offset(list
, offsetof(traffic_selector_t
, destroy
));
636 b
->end_list(b
/* local-ts */);
638 b
->begin_list(b
, "remote-ts");
639 list
= cfg
->get_traffic_selectors(cfg
, FALSE
, NULL
, NULL
, FALSE
);
640 enumerator
= list
->create_enumerator(list
);
641 while (enumerator
->enumerate(enumerator
, &ts
))
643 b
->add_li(b
, "%R", ts
);
645 enumerator
->destroy(enumerator
);
646 list
->destroy_offset(list
, offsetof(traffic_selector_t
, destroy
));
647 b
->end_list(b
/* remote-ts */);
651 this->dispatcher
->raise_event(this->dispatcher
, "list-policy", id
,
655 CALLBACK(list_policies
, vici_message_t
*,
656 private_vici_query_t
*this, char *name
, u_int id
, vici_message_t
*request
)
658 enumerator_t
*enumerator
;
660 child_sa_t
*child_sa
;
661 peer_cfg_t
*peer_cfg
;
662 child_cfg_t
*child_cfg
;
663 bool drop
, pass
, trap
;
664 char *child
, *ike
, *ns
;
666 drop
= request
->get_str(request
, NULL
, "drop") != NULL
;
667 pass
= request
->get_str(request
, NULL
, "pass") != NULL
;
668 trap
= request
->get_str(request
, NULL
, "trap") != NULL
;
669 child
= request
->get_str(request
, NULL
, "child");
670 ike
= request
->get_str(request
, NULL
, "ike");
674 enumerator
= charon
->traps
->create_enumerator(charon
->traps
);
675 while (enumerator
->enumerate(enumerator
, &peer_cfg
, &child_sa
))
677 if ((ike
&& !streq(ike
, peer_cfg
->get_name(peer_cfg
))) ||
678 (child
&& !streq(child
, child_sa
->get_name(child_sa
))))
682 raise_policy(this, id
, peer_cfg
->get_name(peer_cfg
), child_sa
);
684 enumerator
->destroy(enumerator
);
689 enumerator
= charon
->shunts
->create_enumerator(charon
->shunts
);
690 while (enumerator
->enumerate(enumerator
, &ns
, &child_cfg
))
692 if ((ike
&& !streq(ike
, ns
)) ||
693 (child
&& !streq(child
, child_cfg
->get_name(child_cfg
))))
697 switch (child_cfg
->get_mode(child_cfg
))
702 raise_policy_cfg(this, id
, ns
, child_cfg
);
708 raise_policy_cfg(this, id
, ns
, child_cfg
);
715 enumerator
->destroy(enumerator
);
718 b
= vici_builder_create();
719 return b
->finalize(b
);
723 * Build sections for auth configs, local or remote
725 static void build_auth_cfgs(peer_cfg_t
*peer_cfg
, bool local
, vici_builder_t
*b
)
727 enumerator_t
*enumerator
, *rules
;
732 identification_t
*id
;
739 enumerator
= peer_cfg
->create_auth_cfg_enumerator(peer_cfg
, local
);
740 while (enumerator
->enumerate(enumerator
, &auth
))
742 snprintf(buf
, sizeof(buf
), "%s-%d", local ?
"local" : "remote", ++i
);
743 b
->begin_section(b
, buf
);
745 rules
= auth
->create_enumerator(auth
);
746 while (rules
->enumerate(rules
, &rule
, &v
))
750 case AUTH_RULE_AUTH_CLASS
:
751 b
->add_kv(b
, "class", "%N", auth_class_names
, v
.u
);
753 case AUTH_RULE_EAP_TYPE
:
754 b
->add_kv(b
, "eap-type", "%N", eap_type_names
, v
.u
);
756 case AUTH_RULE_EAP_VENDOR
:
757 b
->add_kv(b
, "eap-vendor", "%u", v
.u
);
759 case AUTH_RULE_XAUTH_BACKEND
:
760 b
->add_kv(b
, "xauth", "%s", v
.str
);
762 case AUTH_RULE_CRL_VALIDATION
:
763 b
->add_kv(b
, "revocation", "%N", cert_validation_names
, v
.u
);
765 case AUTH_RULE_IDENTITY
:
766 b
->add_kv(b
, "id", "%Y", v
.id
);
768 case AUTH_RULE_AAA_IDENTITY
:
769 b
->add_kv(b
, "aaa_id", "%Y", v
.id
);
771 case AUTH_RULE_EAP_IDENTITY
:
772 b
->add_kv(b
, "eap_id", "%Y", v
.id
);
774 case AUTH_RULE_XAUTH_IDENTITY
:
775 b
->add_kv(b
, "xauth_id", "%Y", v
.id
);
781 rules
->destroy(rules
);
783 b
->begin_list(b
, "groups");
784 rules
= auth
->create_enumerator(auth
);
785 while (rules
->enumerate(rules
, &rule
, &v
))
787 if (rule
== AUTH_RULE_GROUP
)
789 b
->add_li(b
, "%Y", v
.id
);
792 rules
->destroy(rules
);
795 b
->begin_list(b
, "cert_policy");
796 rules
= auth
->create_enumerator(auth
);
797 while (rules
->enumerate(rules
, &rule
, &v
))
799 if (rule
== AUTH_RULE_CERT_POLICY
)
801 b
->add_li(b
, "%s", v
.str
);
804 rules
->destroy(rules
);
807 b
->begin_list(b
, "certs");
808 rules
= auth
->create_enumerator(auth
);
809 while (rules
->enumerate(rules
, &rule
, &v
))
811 if (rule
== AUTH_RULE_SUBJECT_CERT
)
813 b
->add_li(b
, "%Y", v
.cert
->get_subject(v
.cert
));
816 rules
->destroy(rules
);
819 b
->begin_list(b
, "cacerts");
820 rules
= auth
->create_enumerator(auth
);
821 while (rules
->enumerate(rules
, &rule
, &v
))
823 if (rule
== AUTH_RULE_CA_CERT
)
825 b
->add_li(b
, "%Y", v
.cert
->get_subject(v
.cert
));
828 rules
->destroy(rules
);
833 enumerator
->destroy(enumerator
);
836 CALLBACK(list_conns
, vici_message_t
*,
837 private_vici_query_t
*this, char *name
, u_int id
, vici_message_t
*request
)
839 enumerator_t
*enumerator
, *tokens
, *selectors
, *children
;
840 peer_cfg_t
*peer_cfg
;
842 child_cfg_t
*child_cfg
;
843 char *ike
, *str
, *interface
;
844 uint32_t manual_prio
, dpd_delay
, dpd_timeout
;
845 identification_t
*ppk_id
;
847 traffic_selector_t
*ts
;
851 ike
= request
->get_str(request
, NULL
, "ike");
853 enumerator
= charon
->backends
->create_peer_cfg_enumerator(charon
->backends
,
854 NULL
, NULL
, NULL
, NULL
, IKE_ANY
);
855 while (enumerator
->enumerate(enumerator
, &peer_cfg
))
857 if (ike
&& !streq(ike
, peer_cfg
->get_name(peer_cfg
)))
862 b
= vici_builder_create();
863 b
->begin_section(b
, peer_cfg
->get_name(peer_cfg
));
865 ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
867 b
->begin_list(b
, "local_addrs");
868 str
= ike_cfg
->get_my_addr(ike_cfg
);
869 tokens
= enumerator_create_token(str
, ",", " ");
870 while (tokens
->enumerate(tokens
, &str
))
872 b
->add_li(b
, "%s", str
);
874 tokens
->destroy(tokens
);
877 b
->begin_list(b
, "remote_addrs");
878 str
= ike_cfg
->get_other_addr(ike_cfg
);
879 tokens
= enumerator_create_token(str
, ",", " ");
880 while (tokens
->enumerate(tokens
, &str
))
882 b
->add_li(b
, "%s", str
);
884 tokens
->destroy(tokens
);
887 b
->add_kv(b
, "version", "%N", ike_version_names
,
888 peer_cfg
->get_ike_version(peer_cfg
));
889 b
->add_kv(b
, "reauth_time", "%u",
890 peer_cfg
->get_reauth_time(peer_cfg
, FALSE
));
891 b
->add_kv(b
, "rekey_time", "%u",
892 peer_cfg
->get_rekey_time(peer_cfg
, FALSE
));
893 b
->add_kv(b
, "unique", "%N", unique_policy_names
,
894 peer_cfg
->get_unique_policy(peer_cfg
));
896 dpd_delay
= peer_cfg
->get_dpd(peer_cfg
);
899 b
->add_kv(b
, "dpd_delay", "%u", dpd_delay
);
902 dpd_timeout
= peer_cfg
->get_dpd_timeout(peer_cfg
);
905 b
->add_kv(b
, "dpd_timeout", "%u", dpd_timeout
);
908 ppk_id
= peer_cfg
->get_ppk_id(peer_cfg
);
911 b
->add_kv(b
, "ppk_id", "%Y", ppk_id
);
913 if (peer_cfg
->ppk_required(peer_cfg
))
915 b
->add_kv(b
, "ppk_required", "yes");
918 build_auth_cfgs(peer_cfg
, TRUE
, b
);
919 build_auth_cfgs(peer_cfg
, FALSE
, b
);
921 b
->begin_section(b
, "children");
923 children
= peer_cfg
->create_child_cfg_enumerator(peer_cfg
);
924 while (children
->enumerate(children
, &child_cfg
))
926 b
->begin_section(b
, child_cfg
->get_name(child_cfg
));
928 list_mode(b
, NULL
, child_cfg
);
930 lft
= child_cfg
->get_lifetime(child_cfg
, FALSE
);
931 b
->add_kv(b
, "rekey_time", "%"PRIu64
, lft
->time
.rekey
);
932 b
->add_kv(b
, "rekey_bytes", "%"PRIu64
, lft
->bytes
.rekey
);
933 b
->add_kv(b
, "rekey_packets", "%"PRIu64
, lft
->packets
.rekey
);
936 b
->add_kv(b
, "dpd_action", "%N", action_names
,
937 child_cfg
->get_dpd_action(child_cfg
));
938 b
->add_kv(b
, "close_action", "%N", action_names
,
939 child_cfg
->get_close_action(child_cfg
));
941 b
->begin_list(b
, "local-ts");
942 list
= child_cfg
->get_traffic_selectors(child_cfg
, TRUE
, NULL
,
944 selectors
= list
->create_enumerator(list
);
945 while (selectors
->enumerate(selectors
, &ts
))
947 b
->add_li(b
, "%R", ts
);
949 selectors
->destroy(selectors
);
950 list
->destroy_offset(list
, offsetof(traffic_selector_t
, destroy
));
951 b
->end_list(b
/* local-ts */);
953 b
->begin_list(b
, "remote-ts");
954 list
= child_cfg
->get_traffic_selectors(child_cfg
, FALSE
, NULL
,
956 selectors
= list
->create_enumerator(list
);
957 while (selectors
->enumerate(selectors
, &ts
))
959 b
->add_li(b
, "%R", ts
);
961 selectors
->destroy(selectors
);
962 list
->destroy_offset(list
, offsetof(traffic_selector_t
, destroy
));
963 b
->end_list(b
/* remote-ts */);
965 interface
= child_cfg
->get_interface(child_cfg
);
968 b
->add_kv(b
, "interface", "%s", interface
);
971 manual_prio
= child_cfg
->get_manual_prio(child_cfg
);
974 b
->add_kv(b
, "priority", "%u", manual_prio
);
979 children
->destroy(children
);
981 b
->end_section(b
); /* children */
983 b
->end_section(b
); /* name */
985 this->dispatcher
->raise_event(this->dispatcher
, "list-conn", id
,
988 enumerator
->destroy(enumerator
);
990 b
= vici_builder_create();
991 return b
->finalize(b
);
995 * Do we have a private key for given certificate
997 static bool has_privkey(certificate_t
*cert
)
999 private_key_t
*private;
1000 public_key_t
*public;
1001 identification_t
*keyid
;
1005 public = cert
->get_public_key(cert
);
1008 if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1
, &chunk
))
1010 keyid
= identification_create_from_encoding(ID_KEY_ID
, chunk
);
1011 private = lib
->credmgr
->get_private(lib
->credmgr
,
1012 public->get_type(public), keyid
, NULL
);
1016 private->destroy(private);
1018 keyid
->destroy(keyid
);
1020 public->destroy(public);
1026 * Store cert filter data
1029 certificate_type_t type
;
1031 identification_t
*subject
;
1035 * Enumerate all X.509 certificates with a given flag
1037 static void enum_x509(private_vici_query_t
*this, u_int id
,
1038 linked_list_t
*certs
, cert_filter_t
*filter
,
1041 enumerator_t
*enumerator
;
1042 certificate_t
*cert
;
1047 if (filter
->type
!= CERT_ANY
&& filter
->flag
!= X509_ANY
&&
1048 filter
->flag
!= flag
)
1053 enumerator
= certs
->create_enumerator(certs
);
1054 while (enumerator
->enumerate(enumerator
, &cert
))
1056 x509
= (x509_t
*)cert
;
1057 if ((x509
->get_flags(x509
) & X509_ANY
) != flag
)
1062 if (cert
->get_encoding(cert
, CERT_ASN1_DER
, &encoding
))
1064 b
= vici_builder_create();
1065 b
->add_kv(b
, "type", "%N", certificate_type_names
, CERT_X509
);
1066 b
->add_kv(b
, "flag", "%N", x509_flag_names
, flag
);
1067 if (has_privkey(cert
))
1069 b
->add_kv(b
, "has_privkey", "yes");
1071 b
->add(b
, VICI_KEY_VALUE
, "data", encoding
);
1074 this->dispatcher
->raise_event(this->dispatcher
, "list-cert", id
,
1078 enumerator
->destroy(enumerator
);
1082 * Enumerate all non-X.509 certificate types
1084 static void enum_others(private_vici_query_t
*this, u_int id
,
1085 linked_list_t
*certs
, certificate_type_t type
)
1087 enumerator_t
*enumerator
;
1088 certificate_t
*cert
;
1090 chunk_t encoding
, t_ch
;
1091 cred_encoding_type_t encoding_type
;
1092 identification_t
*subject
;
1093 time_t not_before
, not_after
;
1095 encoding_type
= (type
== CERT_TRUSTED_PUBKEY
) ? PUBKEY_SPKI_ASN1_DER
:
1098 enumerator
= certs
->create_enumerator(certs
);
1099 while (enumerator
->enumerate(enumerator
, &cert
))
1101 if (cert
->get_encoding(cert
, encoding_type
, &encoding
))
1103 b
= vici_builder_create();
1104 b
->add_kv(b
, "type", "%N", certificate_type_names
, type
);
1105 if (has_privkey(cert
))
1107 b
->add_kv(b
, "has_privkey", "yes");
1109 b
->add(b
, VICI_KEY_VALUE
, "data", encoding
);
1112 if (type
== CERT_TRUSTED_PUBKEY
)
1114 subject
= cert
->get_subject(cert
);
1115 if (subject
->get_type(subject
) != ID_KEY_ID
)
1117 b
->add_kv(b
, "subject", "%Y", cert
->get_subject(cert
));
1119 cert
->get_validity(cert
, NULL
, ¬_before
, ¬_after
);
1120 if (not_before
!= UNDEFINED_TIME
)
1122 t_ch
= asn1_from_time(¬_before
, ASN1_GENERALIZEDTIME
);
1123 b
->add(b
, VICI_KEY_VALUE
, "not-before", chunk_skip(t_ch
, 2));
1126 if (not_after
!= UNDEFINED_TIME
)
1128 t_ch
= asn1_from_time(¬_after
, ASN1_GENERALIZEDTIME
);
1129 b
->add(b
, VICI_KEY_VALUE
, "not-after", chunk_skip(t_ch
, 2));
1133 this->dispatcher
->raise_event(this->dispatcher
, "list-cert", id
,
1137 enumerator
->destroy(enumerator
);
1141 * Enumerate all certificates of a given type
1143 static void enum_certs(private_vici_query_t
*this, u_int id
,
1144 cert_filter_t
*filter
, certificate_type_t type
)
1146 enumerator_t
*e1
, *e2
;
1147 certificate_t
*cert
, *current
;
1148 linked_list_t
*certs
;
1151 if (filter
->type
!= CERT_ANY
&& filter
->type
!= type
)
1155 certs
= linked_list_create();
1157 e1
= lib
->credmgr
->create_cert_enumerator(lib
->credmgr
, type
, KEY_ANY
,
1158 filter
->subject
, FALSE
);
1159 while (e1
->enumerate(e1
, &cert
))
1163 e2
= certs
->create_enumerator(certs
);
1164 while (e2
->enumerate(e2
, ¤t
))
1166 if (current
->equals(current
, cert
))
1176 certs
->insert_last(certs
, cert
->get_ref(cert
));
1181 if (type
== CERT_X509
)
1183 enum_x509(this, id
, certs
, filter
, X509_NONE
);
1184 enum_x509(this, id
, certs
, filter
, X509_CA
);
1185 enum_x509(this, id
, certs
, filter
, X509_AA
);
1186 enum_x509(this, id
, certs
, filter
, X509_OCSP_SIGNER
);
1190 enum_others(this, id
, certs
, type
);
1192 certs
->destroy_offset(certs
, offsetof(certificate_t
, destroy
));
1195 CALLBACK(list_certs
, vici_message_t
*,
1196 private_vici_query_t
*this, char *name
, u_int id
, vici_message_t
*request
)
1198 cert_filter_t filter
= {
1206 str
= request
->get_str(request
, "ANY", "type");
1207 if (enum_from_name(certificate_type_names
, str
, &filter
.type
))
1209 if (filter
.type
== CERT_X509
)
1211 str
= request
->get_str(request
, "ANY", "flag");
1212 if (!enum_from_name(x509_flag_names
, str
, &filter
.flag
))
1214 DBG1(DBG_CFG
, "invalid certificate flag '%s'", str
);
1219 else if (!vici_cert_info_from_str(str
, &filter
.type
, &filter
.flag
))
1221 DBG1(DBG_CFG
, "invalid certificate type '%s'", str
);
1225 str
= request
->get_str(request
, NULL
, "subject");
1228 filter
.subject
= identification_create_from_string(str
);
1231 enum_certs(this, id
, &filter
, CERT_TRUSTED_PUBKEY
);
1232 enum_certs(this, id
, &filter
, CERT_X509
);
1233 enum_certs(this, id
, &filter
, CERT_X509_AC
);
1234 enum_certs(this, id
, &filter
, CERT_X509_CRL
);
1235 enum_certs(this, id
, &filter
, CERT_X509_OCSP_RESPONSE
);
1236 DESTROY_IF(filter
.subject
);
1239 b
= vici_builder_create();
1240 return b
->finalize(b
);
1244 * Add a key/value pair of ALG => plugin
1246 static void add_algorithm(vici_builder_t
*b
, enum_name_t
*alg_names
,
1247 int alg_type
, const char *plugin_name
)
1249 char alg_name
[BUF_LEN
];
1251 sprintf(alg_name
, "%N", alg_names
, alg_type
);
1252 b
->add_kv(b
, alg_name
, (char*)plugin_name
);
1255 CALLBACK(get_algorithms
, vici_message_t
*,
1256 private_vici_query_t
*this, char *name
, u_int id
, vici_message_t
*request
)
1259 enumerator_t
*enumerator
;
1260 encryption_algorithm_t encryption
;
1261 integrity_algorithm_t integrity
;
1262 hash_algorithm_t hash
;
1263 pseudo_random_function_t prf
;
1264 ext_out_function_t xof
;
1266 diffie_hellman_group_t group
;
1267 rng_quality_t quality
;
1268 const char *plugin_name
;
1270 b
= vici_builder_create();
1272 b
->begin_section(b
, "encryption");
1273 enumerator
= lib
->crypto
->create_crypter_enumerator(lib
->crypto
);
1274 while (enumerator
->enumerate(enumerator
, &encryption
, &plugin_name
))
1276 add_algorithm(b
, encryption_algorithm_names
, encryption
, plugin_name
);
1278 enumerator
->destroy(enumerator
);
1281 b
->begin_section(b
, "integrity");
1282 enumerator
= lib
->crypto
->create_signer_enumerator(lib
->crypto
);
1283 while (enumerator
->enumerate(enumerator
, &integrity
, &plugin_name
))
1285 add_algorithm(b
, integrity_algorithm_names
, integrity
, plugin_name
);
1287 enumerator
->destroy(enumerator
);
1290 b
->begin_section(b
, "aead");
1291 enumerator
= lib
->crypto
->create_aead_enumerator(lib
->crypto
);
1292 while (enumerator
->enumerate(enumerator
, &encryption
, &plugin_name
))
1294 add_algorithm(b
, encryption_algorithm_names
, encryption
, plugin_name
);
1296 enumerator
->destroy(enumerator
);
1299 b
->begin_section(b
, "hasher");
1300 enumerator
= lib
->crypto
->create_hasher_enumerator(lib
->crypto
);
1301 while (enumerator
->enumerate(enumerator
, &hash
, &plugin_name
))
1303 add_algorithm(b
, hash_algorithm_names
, hash
, plugin_name
);
1305 enumerator
->destroy(enumerator
);
1308 b
->begin_section(b
, "prf");
1309 enumerator
= lib
->crypto
->create_prf_enumerator(lib
->crypto
);
1310 while (enumerator
->enumerate(enumerator
, &prf
, &plugin_name
))
1312 add_algorithm(b
, pseudo_random_function_names
, prf
, plugin_name
);
1314 enumerator
->destroy(enumerator
);
1317 b
->begin_section(b
, "xof");
1318 enumerator
= lib
->crypto
->create_xof_enumerator(lib
->crypto
);
1319 while (enumerator
->enumerate(enumerator
, &xof
, &plugin_name
))
1321 add_algorithm(b
, ext_out_function_names
, xof
, plugin_name
);
1323 enumerator
->destroy(enumerator
);
1326 b
->begin_section(b
, "drbg");
1327 enumerator
= lib
->crypto
->create_drbg_enumerator(lib
->crypto
);
1328 while (enumerator
->enumerate(enumerator
, &drbg
, &plugin_name
))
1330 add_algorithm(b
, drbg_type_names
, drbg
, plugin_name
);
1332 enumerator
->destroy(enumerator
);
1335 b
->begin_section(b
, "dh");
1336 enumerator
= lib
->crypto
->create_dh_enumerator(lib
->crypto
);
1337 while (enumerator
->enumerate(enumerator
, &group
, &plugin_name
))
1339 add_algorithm(b
, diffie_hellman_group_names
, group
, plugin_name
);
1341 enumerator
->destroy(enumerator
);
1344 b
->begin_section(b
, "rng");
1345 enumerator
= lib
->crypto
->create_rng_enumerator(lib
->crypto
);
1346 while (enumerator
->enumerate(enumerator
, &quality
, &plugin_name
))
1348 add_algorithm(b
, rng_quality_names
, quality
, plugin_name
);
1350 enumerator
->destroy(enumerator
);
1353 b
->begin_section(b
, "nonce-gen");
1354 enumerator
= lib
->crypto
->create_nonce_gen_enumerator(lib
->crypto
);
1355 while (enumerator
->enumerate(enumerator
, &plugin_name
))
1357 b
->add_kv(b
, "NONCE_GEN", (char*)plugin_name
);
1359 enumerator
->destroy(enumerator
);
1362 return b
->finalize(b
);
1366 * Make sure we have the counters query interface
1368 static inline bool ensure_counters(private_vici_query_t
*this)
1374 return (this->counters
= lib
->get(lib
, "counters")) != NULL
;
1378 * Add a single set of counters to the message
1380 * Frees the array of counter values
1382 static void add_counters(vici_builder_t
*b
, char *name
, uint64_t *counters
)
1387 b
->begin_section(b
, name ?
: "");
1388 for (i
= 0; i
< COUNTER_MAX
; i
++)
1390 snprintf(buf
, sizeof(buf
), "%N", vici_counter_type_names
, i
);
1391 b
->add_kv(b
, buf
, "%"PRIu64
, counters
[i
]);
1397 CALLBACK(get_counters
, vici_message_t
*,
1398 private_vici_query_t
*this, char *name
, u_int id
, vici_message_t
*request
)
1401 enumerator_t
*enumerator
;
1403 char *conn
, *errmsg
= NULL
;
1406 b
= vici_builder_create();
1408 if (ensure_counters(this))
1410 conn
= request
->get_str(request
, NULL
, "name");
1411 all
= request
->get_bool(request
, FALSE
, "all");
1413 b
->begin_section(b
, "counters");
1416 enumerator
= this->counters
->get_names(this->counters
);
1417 while (enumerator
->enumerate(enumerator
, &conn
))
1419 counters
= this->counters
->get_all(this->counters
, conn
);
1422 add_counters(b
, conn
, counters
);
1425 enumerator
->destroy(enumerator
);
1429 counters
= this->counters
->get_all(this->counters
, conn
);
1432 add_counters(b
, conn
, counters
);
1436 errmsg
= "no counters found for this connection";
1443 errmsg
= "no counters available (plugin missing?)";
1446 b
->add_kv(b
, "success", errmsg ?
"no" : "yes");
1449 b
->add_kv(b
, "errmsg", "%s", errmsg
);
1451 return b
->finalize(b
);
1454 CALLBACK(reset_counters
, vici_message_t
*,
1455 private_vici_query_t
*this, char *name
, u_int id
, vici_message_t
*request
)
1458 char *conn
, *errmsg
= NULL
;
1461 b
= vici_builder_create();
1463 if (ensure_counters(this))
1465 conn
= request
->get_str(request
, NULL
, "name");
1466 all
= request
->get_bool(request
, FALSE
, "all");
1470 this->counters
->reset_all(this->counters
);
1474 this->counters
->reset(this->counters
, conn
);
1479 errmsg
= "no counters available (plugin missing?)";
1482 b
->add_kv(b
, "success", errmsg ?
"no" : "yes");
1485 b
->add_kv(b
, "errmsg", "%s", errmsg
);
1487 return b
->finalize(b
);
1490 CALLBACK(version
, vici_message_t
*,
1491 private_vici_query_t
*this, char *name
, u_int id
, vici_message_t
*request
)
1495 b
= vici_builder_create();
1496 b
->add_kv(b
, "daemon", "%s", lib
->ns
);
1497 b
->add_kv(b
, "version", "%s", VERSION
);
1501 OSVERSIONINFOEX osvie
;
1503 memset(&osvie
, 0, sizeof(osvie
));
1504 osvie
.dwOSVersionInfoSize
= sizeof(osvie
);
1506 if (GetVersionEx((LPOSVERSIONINFO
)&osvie
))
1508 b
->add_kv(b
, "sysname", "Windows %s",
1509 osvie
.wProductType
== VER_NT_WORKSTATION ?
"Client" : "Server");
1510 b
->add_kv(b
, "release", "%d.%d.%d (SP %d.%d)",
1511 osvie
.dwMajorVersion
, osvie
.dwMinorVersion
, osvie
.dwBuildNumber
,
1512 osvie
.wServicePackMajor
, osvie
.wServicePackMinor
);
1513 b
->add_kv(b
, "machine", "%s",
1523 struct utsname utsname
;
1525 if (uname(&utsname
) == 0)
1527 b
->add_kv(b
, "sysname", "%s", utsname
.sysname
);
1528 b
->add_kv(b
, "release", "%s", utsname
.release
);
1529 b
->add_kv(b
, "machine", "%s", utsname
.machine
);
1533 return b
->finalize(b
);
1536 CALLBACK(stats
, vici_message_t
*,
1537 private_vici_query_t
*this, char *name
, u_int id
, vici_message_t
*request
)
1540 enumerator_t
*enumerator
;
1545 b
= vici_builder_create();
1547 now
= time_monotonic(NULL
);
1548 since
= time(NULL
) - (now
- this->uptime
);
1550 b
->begin_section(b
, "uptime");
1551 b
->add_kv(b
, "running", "%V", &now
, &this->uptime
);
1552 b
->add_kv(b
, "since", "%T", &since
, FALSE
);
1555 b
->begin_section(b
, "workers");
1556 b
->add_kv(b
, "total", "%d",
1557 lib
->processor
->get_total_threads(lib
->processor
));
1558 b
->add_kv(b
, "idle", "%d",
1559 lib
->processor
->get_idle_threads(lib
->processor
));
1560 b
->begin_section(b
, "active");
1561 for (i
= 0; i
< JOB_PRIO_MAX
; i
++)
1563 b
->add_kv(b
, enum_to_name(job_priority_names
, i
), "%d",
1564 lib
->processor
->get_working_threads(lib
->processor
, i
));
1569 b
->begin_section(b
, "queues");
1570 for (i
= 0; i
< JOB_PRIO_MAX
; i
++)
1572 b
->add_kv(b
, enum_to_name(job_priority_names
, i
), "%d",
1573 lib
->processor
->get_job_load(lib
->processor
, i
));
1577 b
->add_kv(b
, "scheduled", "%d",
1578 lib
->scheduler
->get_job_load(lib
->scheduler
));
1580 b
->begin_section(b
, "ikesas");
1581 b
->add_kv(b
, "total", "%u",
1582 charon
->ike_sa_manager
->get_count(charon
->ike_sa_manager
));
1583 b
->add_kv(b
, "half-open", "%u",
1584 charon
->ike_sa_manager
->get_half_open_count(charon
->ike_sa_manager
,
1588 b
->begin_list(b
, "plugins");
1589 enumerator
= lib
->plugins
->create_plugin_enumerator(lib
->plugins
);
1590 while (enumerator
->enumerate(enumerator
, &plugin
, NULL
))
1592 b
->add_li(b
, "%s", plugin
->get_name(plugin
));
1594 enumerator
->destroy(enumerator
);
1599 DWORD lasterr
= ERROR_INVALID_HANDLE
;
1606 b
->begin_section(b
, "mem");
1607 count
= GetProcessHeaps(countof(heaps
), heaps
);
1608 for (i
= 0; i
< count
; i
++)
1610 PROCESS_HEAP_ENTRY entry
= {};
1611 size_t heap_total
= 0;
1612 int heap_allocs
= 0;
1614 if (HeapLock(heaps
[i
]))
1616 while (HeapWalk(heaps
[i
], &entry
))
1618 if (entry
.wFlags
& PROCESS_HEAP_ENTRY_BUSY
)
1620 heap_total
+= entry
.cbData
;
1624 lasterr
= GetLastError();
1625 HeapUnlock(heaps
[i
]);
1627 if (lasterr
!= ERROR_NO_MORE_ITEMS
)
1631 snprintf(buf
, sizeof(buf
), "heap-%d", i
);
1632 b
->begin_section(b
, buf
);
1633 b
->add_kv(b
, "total", "%zu", heap_total
);
1634 b
->add_kv(b
, "allocs", "%d", heap_allocs
);
1637 total
+= heap_total
;
1638 allocs
+= heap_allocs
;
1640 if (lasterr
== ERROR_NO_MORE_ITEMS
)
1642 b
->add_kv(b
, "total", "%zu", total
);
1643 b
->add_kv(b
, "allocs", "%d", allocs
);
1649 #ifdef HAVE_MALLINFO
1651 struct mallinfo mi
= mallinfo();
1653 b
->begin_section(b
, "mallinfo");
1654 b
->add_kv(b
, "sbrk", "%u", mi
.arena
);
1655 b
->add_kv(b
, "mmap", "%u", mi
.hblkhd
);
1656 b
->add_kv(b
, "used", "%u", mi
.uordblks
);
1657 b
->add_kv(b
, "free", "%u", mi
.fordblks
);
1660 #endif /* HAVE_MALLINFO */
1662 return b
->finalize(b
);
1665 static void manage_command(private_vici_query_t
*this,
1666 char *name
, vici_command_cb_t cb
, bool reg
)
1668 this->dispatcher
->manage_command(this->dispatcher
, name
,
1669 reg ? cb
: NULL
, this);
1673 * (Un-)register dispatcher functions
1675 static void manage_commands(private_vici_query_t
*this, bool reg
)
1677 this->dispatcher
->manage_event(this->dispatcher
, "list-sa", reg
);
1678 this->dispatcher
->manage_event(this->dispatcher
, "list-policy", reg
);
1679 this->dispatcher
->manage_event(this->dispatcher
, "list-conn", reg
);
1680 this->dispatcher
->manage_event(this->dispatcher
, "list-cert", reg
);
1681 this->dispatcher
->manage_event(this->dispatcher
, "ike-updown", reg
);
1682 this->dispatcher
->manage_event(this->dispatcher
, "ike-rekey", reg
);
1683 this->dispatcher
->manage_event(this->dispatcher
, "child-updown", reg
);
1684 this->dispatcher
->manage_event(this->dispatcher
, "child-rekey", reg
);
1685 manage_command(this, "list-sas", list_sas
, reg
);
1686 manage_command(this, "list-policies", list_policies
, reg
);
1687 manage_command(this, "list-conns", list_conns
, reg
);
1688 manage_command(this, "list-certs", list_certs
, reg
);
1689 manage_command(this, "get-algorithms", get_algorithms
, reg
);
1690 manage_command(this, "get-counters", get_counters
, reg
);
1691 manage_command(this, "reset-counters", reset_counters
, reg
);
1692 manage_command(this, "version", version
, reg
);
1693 manage_command(this, "stats", stats
, reg
);
1696 METHOD(listener_t
, ike_updown
, bool,
1697 private_vici_query_t
*this, ike_sa_t
*ike_sa
, bool up
)
1702 if (!this->dispatcher
->has_event_listeners(this->dispatcher
, "ike-updown"))
1707 now
= time_monotonic(NULL
);
1709 b
= vici_builder_create();
1713 b
->add_kv(b
, "up", "yes");
1716 b
->begin_section(b
, ike_sa
->get_name(ike_sa
));
1717 list_ike(this, b
, ike_sa
, now
);
1720 this->dispatcher
->raise_event(this->dispatcher
,
1721 "ike-updown", 0, b
->finalize(b
));
1726 METHOD(listener_t
, ike_rekey
, bool,
1727 private_vici_query_t
*this, ike_sa_t
*old
, ike_sa_t
*new)
1732 if (!this->dispatcher
->has_event_listeners(this->dispatcher
, "ike-rekey"))
1737 now
= time_monotonic(NULL
);
1739 b
= vici_builder_create();
1740 b
->begin_section(b
, old
->get_name(old
));
1741 b
->begin_section(b
, "old");
1742 list_ike(this, b
, old
, now
);
1744 b
->begin_section(b
, "new");
1745 list_ike(this, b
, new, now
);
1749 this->dispatcher
->raise_event(this->dispatcher
,
1750 "ike-rekey", 0, b
->finalize(b
));
1755 METHOD(listener_t
, child_updown
, bool,
1756 private_vici_query_t
*this, ike_sa_t
*ike_sa
, child_sa_t
*child_sa
, bool up
)
1762 if (!this->dispatcher
->has_event_listeners(this->dispatcher
, "child-updown"))
1767 now
= time_monotonic(NULL
);
1768 b
= vici_builder_create();
1772 b
->add_kv(b
, "up", "yes");
1775 b
->begin_section(b
, ike_sa
->get_name(ike_sa
));
1776 list_ike(this, b
, ike_sa
, now
);
1777 b
->begin_section(b
, "child-sas");
1779 snprintf(buf
, sizeof(buf
), "%s-%u", child_sa
->get_name(child_sa
),
1780 child_sa
->get_unique_id(child_sa
));
1782 b
->begin_section(b
, buf
);
1783 list_child(this, b
, child_sa
, now
);
1789 this->dispatcher
->raise_event(this->dispatcher
,
1790 "child-updown", 0, b
->finalize(b
));
1795 METHOD(listener_t
, child_rekey
, bool,
1796 private_vici_query_t
*this, ike_sa_t
*ike_sa
, child_sa_t
*old
,
1802 if (!this->dispatcher
->has_event_listeners(this->dispatcher
, "child-rekey"))
1807 now
= time_monotonic(NULL
);
1808 b
= vici_builder_create();
1810 b
->begin_section(b
, ike_sa
->get_name(ike_sa
));
1811 list_ike(this, b
, ike_sa
, now
);
1812 b
->begin_section(b
, "child-sas");
1814 b
->begin_section(b
, old
->get_name(old
));
1816 b
->begin_section(b
, "old");
1817 list_child(this, b
, old
, now
);
1819 b
->begin_section(b
, "new");
1820 list_child(this, b
, new, now
);
1828 this->dispatcher
->raise_event(this->dispatcher
,
1829 "child-rekey", 0, b
->finalize(b
));
1834 METHOD(vici_query_t
, destroy
, void,
1835 private_vici_query_t
*this)
1837 manage_commands(this, FALSE
);
1844 vici_query_t
*vici_query_create(vici_dispatcher_t
*dispatcher
)
1846 private_vici_query_t
*this;
1851 .ike_updown
= _ike_updown
,
1852 .ike_rekey
= _ike_rekey
,
1853 .child_updown
= _child_updown
,
1854 .child_rekey
= _child_rekey
,
1856 .destroy
= _destroy
,
1858 .dispatcher
= dispatcher
,
1859 .uptime
= time_monotonic(NULL
),
1862 manage_commands(this, TRUE
);
1864 return &this->public;