projects / strongswan.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
vici: List additional information for deleted CHILD_SAs
[strongswan.git] / src / libcharon / plugins / vici / vici_query.c
1 /*
2 * Copyright (C) 2015-2017 Tobias Brunner
3 * Copyright (C) 2015-2018 Andreas Steffen
4 * HSR Hochschule fuer Technik Rapperswil
5 *
6 * Copyright (C) 2014 Martin Willi
7 * Copyright (C) 2014 revosec AG
8 *
9 * This program is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by the
11 * Free Software Foundation; either version 2 of the License, or (at your
12 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 *
14 * This program is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
16 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 * for more details.
18 */
19
20 /*
21 * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
22 *
23 * Permission is hereby granted, free of charge, to any person obtaining a copy
24 * of this software and associated documentation files (the "Software"), to deal
25 * in the Software without restriction, including without limitation the rights
26 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
27 * copies of the Software, and to permit persons to whom the Software is
28 * furnished to do so, subject to the following conditions:
29 *
30 * The above copyright notice and this permission notice shall be included in
31 * all copies or substantial portions of the Software.
32 *
33 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
34 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
35 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
36 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
37 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
38 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
39 * THE SOFTWARE.
40 */
41
42 #include "vici_query.h"
43 #include "vici_builder.h"
44 #include "vici_cert_info.h"
45
46 #include <inttypes.h>
47 #include <time.h>
48 #ifndef WIN32
49 #include <sys/utsname.h>
50 #endif
51 #ifdef HAVE_MALLINFO
52 #include <malloc.h>
53 #endif
54
55 #include <daemon.h>
56 #include <asn1/asn1.h>
57 #include <credentials/certificates/certificate.h>
58 #include <credentials/certificates/x509.h>
59 #include <counters_query.h>
60
61 ENUM(vici_counter_type_names,
62 COUNTER_INIT_IKE_SA_REKEY, COUNTER_OUT_INFORMATIONAL_RSP,
63 "ike-rekey-init",
64 "ike-rekey-resp",
65 "child-rekey",
66 "invalid",
67 "invalid-spi",
68 "ike-init-in-req",
69 "ike-init-in-resp",
70 "ike-init-out-req",
71 "ike-init-out-resp",
72 "ike-auth-in-req",
73 "ike-auth-in-resp",
74 "ike-auth-out-req",
75 "ike-auth-out-resp",
76 "create-child-in-req",
77 "create-child-in-resp",
78 "create-child-out-req",
79 "create-child-out-resp",
80 "info-in-req",
81 "info-in-resp",
82 "info-out-req",
83 "info-out-resp",
84 );
85
86 typedef struct private_vici_query_t private_vici_query_t;
87
88 /**
89 * Private data of an vici_query_t object.
90 */
91 struct private_vici_query_t {
92
93 /**
94 * Public vici_query_t interface.
95 */
96 vici_query_t public;
97
98 /**
99 * Dispatcher
100 */
101 vici_dispatcher_t *dispatcher;
102
103 /**
104 * Query interface for counters
105 */
106 counters_query_t *counters;
107
108 /**
109 * Daemon startup timestamp
110 */
111 time_t uptime;
112 };
113
114 /**
115 * Add the given mark/mask to the message using the provided labels
116 */
117 static void add_mark(vici_builder_t *b, mark_t mark,
118 char *label, char *mask_label)
119 {
120 if (mark.value | mark.mask)
121 {
122 b->add_kv(b, label, "%.8x", mark.value);
123 if (~mark.mask)
124 {
125 b->add_kv(b, mask_label, "%.8x", mark.mask);
126 }
127 }
128 }
129
130 /**
131 * List the mode of a CHILD_SA or config
132 */
133 static void list_mode(vici_builder_t *b, child_sa_t *child, child_cfg_t *cfg)
134 {
135 ipsec_mode_t mode;
136 char *sub_mode = "";
137
138 if (child || cfg)
139 {
140 if (!cfg)
141 {
142 cfg = child->get_config(child);
143 }
144 mode = child ? child->get_mode(child) : cfg->get_mode(cfg);
145 if (mode == MODE_TRANSPORT && cfg->has_option(cfg, OPT_PROXY_MODE))
146 { /* only report this if the negotiated mode is actually TRANSPORT */
147 sub_mode = "_PROXY";
148 }
149 b->add_kv(b, "mode", "%N%s", ipsec_mode_names, mode, sub_mode);
150 }
151 }
152
153 /**
154 * List IPsec-related details about a CHILD_SA
155 */
156 static void list_child_ipsec(vici_builder_t *b, child_sa_t *child)
157 {
158 proposal_t *proposal;
159 uint16_t alg, ks;
160 uint32_t if_id;
161
162 b->add_kv(b, "protocol", "%N", protocol_id_names,
163 child->get_protocol(child));
164 if (child->has_encap(child))
165 {
166 b->add_kv(b, "encap", "yes");
167 }
168 b->add_kv(b, "spi-in", "%.8x", ntohl(child->get_spi(child, TRUE)));
169 b->add_kv(b, "spi-out", "%.8x", ntohl(child->get_spi(child, FALSE)));
170
171 if (child->get_ipcomp(child) != IPCOMP_NONE)
172 {
173 b->add_kv(b, "cpi-in", "%.4x", ntohs(child->get_cpi(child, TRUE)));
174 b->add_kv(b, "cpi-out", "%.4x", ntohs(child->get_cpi(child, FALSE)));
175 }
176 add_mark(b, child->get_mark(child, TRUE), "mark-in", "mark-mask-in");
177 add_mark(b, child->get_mark(child, FALSE), "mark-out", "mark-mask-out");
178
179 if_id = child->get_if_id(child, TRUE);
180 if (if_id)
181 {
182 b->add_kv(b, "if-id-in", "%.8x", if_id);
183 }
184 if_id = child->get_if_id(child, FALSE);
185 if (if_id)
186 {
187 b->add_kv(b, "if-id-out", "%.8x", if_id);
188 }
189
190 proposal = child->get_proposal(child);
191 if (proposal)
192 {
193 if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
194 &alg, &ks) && alg != ENCR_UNDEFINED)
195 {
196 b->add_kv(b, "encr-alg", "%N", encryption_algorithm_names, alg);
197 if (ks)
198 {
199 b->add_kv(b, "encr-keysize", "%u", ks);
200 }
201 }
202 if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
203 &alg, &ks) && alg != AUTH_UNDEFINED)
204 {
205 b->add_kv(b, "integ-alg", "%N", integrity_algorithm_names, alg);
206 if (ks)
207 {
208 b->add_kv(b, "integ-keysize", "%u", ks);
209 }
210 }
211 if (proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP,
212 &alg, NULL))
213 {
214 b->add_kv(b, "dh-group", "%N", diffie_hellman_group_names, alg);
215 }
216 if (proposal->get_algorithm(proposal, EXTENDED_SEQUENCE_NUMBERS,
217 &alg, NULL) && alg == EXT_SEQ_NUMBERS)
218 {
219 b->add_kv(b, "esn", "1");
220 }
221 }
222 }
223
224 /**
225 * List usage and lifetime stats of a CHILD_SA
226 */
227 static void list_child_stats(vici_builder_t *b, child_sa_t *child, time_t now)
228 {
229 uint64_t bytes, packets;
230 time_t t;
231
232 child->get_usestats(child, TRUE, &t, &bytes, &packets);
233 b->add_kv(b, "bytes-in", "%" PRIu64, bytes);
234 b->add_kv(b, "packets-in", "%" PRIu64, packets);
235 if (t)
236 {
237 b->add_kv(b, "use-in", "%"PRIu64, (uint64_t)(now - t));
238 }
239
240 child->get_usestats(child, FALSE, &t, &bytes, &packets);
241 b->add_kv(b, "bytes-out", "%"PRIu64, bytes);
242 b->add_kv(b, "packets-out", "%"PRIu64, packets);
243 if (t)
244 {
245 b->add_kv(b, "use-out", "%"PRIu64, (uint64_t)(now - t));
246 }
247
248 t = child->get_lifetime(child, FALSE);
249 if (t)
250 {
251 b->add_kv(b, "rekey-time", "%"PRId64, (int64_t)(t - now));
252 }
253 t = child->get_lifetime(child, TRUE);
254 if (t)
255 {
256 b->add_kv(b, "life-time", "%"PRId64, (int64_t)(t - now));
257 }
258 t = child->get_installtime(child);
259 b->add_kv(b, "install-time", "%"PRId64, (int64_t)(now - t));
260 }
261
262 /**
263 * List details of a CHILD_SA
264 */
265 static void list_child(private_vici_query_t *this, vici_builder_t *b,
266 child_sa_t *child, time_t now)
267 {
268 enumerator_t *enumerator;
269 traffic_selector_t *ts;
270 child_sa_state_t state;
271
272 b->add_kv(b, "name", "%s", child->get_name(child));
273 b->add_kv(b, "uniqueid", "%u", child->get_unique_id(child));
274 b->add_kv(b, "reqid", "%u", child->get_reqid(child));
275 state = child->get_state(child);
276 b->add_kv(b, "state", "%N", child_sa_state_names, state);
277 list_mode(b, child, NULL);
278
279 switch (state)
280 {
281 case CHILD_INSTALLED:
282 case CHILD_REKEYING:
283 case CHILD_REKEYED:
284 case CHILD_DELETING:
285 case CHILD_DELETED:
286 list_child_ipsec(b, child);
287 list_child_stats(b, child, now);
288 break;
289 default:
290 break;
291 }
292
293 b->begin_list(b, "local-ts");
294 enumerator = child->create_ts_enumerator(child, TRUE);
295 while (enumerator->enumerate(enumerator, &ts))
296 {
297 b->add_li(b, "%R", ts);
298 }
299 enumerator->destroy(enumerator);
300 b->end_list(b /* local-ts */);
301
302 b->begin_list(b, "remote-ts");
303 enumerator = child->create_ts_enumerator(child, FALSE);
304 while (enumerator->enumerate(enumerator, &ts))
305 {
306 b->add_li(b, "%R", ts);
307 }
308 enumerator->destroy(enumerator);
309 b->end_list(b /* remote-ts */);
310 }
311
312 /**
313 * List tasks in a specific queue
314 */
315 static void list_task_queue(private_vici_query_t *this, vici_builder_t *b,
316 ike_sa_t *ike_sa, task_queue_t q, char *name)
317 {
318 enumerator_t *enumerator;
319 bool has = FALSE;
320 task_t *task;
321
322 enumerator = ike_sa->create_task_enumerator(ike_sa, q);
323 while (enumerator->enumerate(enumerator, &task))
324 {
325 if (!has)
326 {
327 b->begin_list(b, name);
328 has = TRUE;
329 }
330 b->add_li(b, "%N", task_type_names, task->get_type(task));
331 }
332 enumerator->destroy(enumerator);
333 if (has)
334 {
335 b->end_list(b);
336 }
337 }
338
339 /**
340 * Add an IKE_SA condition to the given builder
341 */
342 static void add_condition(vici_builder_t *b, ike_sa_t *ike_sa,
343 char *key, ike_condition_t cond)
344 {
345 if (ike_sa->has_condition(ike_sa, cond))
346 {
347 b->add_kv(b, key, "yes");
348 }
349 }
350
351 /**
352 * List virtual IPs
353 */
354 static void list_vips(private_vici_query_t *this, vici_builder_t *b,
355 ike_sa_t *ike_sa, bool local, char *name)
356 {
357 enumerator_t *enumerator;
358 bool has = FALSE;
359 host_t *vip;
360
361 enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
362 while (enumerator->enumerate(enumerator, &vip))
363 {
364 if (!has)
365 {
366 b->begin_list(b, name);
367 has = TRUE;
368 }
369 b->add_li(b, "%H", vip);
370 }
371 enumerator->destroy(enumerator);
372 if (has)
373 {
374 b->end_list(b);
375 }
376 }
377
378 /**
379 * List details of an IKE_SA
380 */
381 static void list_ike(private_vici_query_t *this, vici_builder_t *b,
382 ike_sa_t *ike_sa, time_t now)
383 {
384 time_t t;
385 ike_sa_id_t *id;
386 identification_t *eap;
387 proposal_t *proposal;
388 uint32_t if_id;
389 uint16_t alg, ks;
390 host_t *host;
391
392 b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa));
393 b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa));
394 b->add_kv(b, "state", "%N", ike_sa_state_names, ike_sa->get_state(ike_sa));
395
396 host = ike_sa->get_my_host(ike_sa);
397 b->add_kv(b, "local-host", "%H", host);
398 b->add_kv(b, "local-port", "%d", host->get_port(host));
399 b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa));
400
401 host = ike_sa->get_other_host(ike_sa);
402 b->add_kv(b, "remote-host", "%H", host);
403 b->add_kv(b, "remote-port", "%d", host->get_port(host));
404 b->add_kv(b, "remote-id", "%Y", ike_sa->get_other_id(ike_sa));
405
406 eap = ike_sa->get_other_eap_id(ike_sa);
407
408 if (!eap->equals(eap, ike_sa->get_other_id(ike_sa)))
409 {
410 if (ike_sa->get_version(ike_sa) == IKEV1)
411 {
412 b->add_kv(b, "remote-xauth-id", "%Y", eap);
413 }
414 else
415 {
416 b->add_kv(b, "remote-eap-id", "%Y", eap);
417 }
418 }
419
420 id = ike_sa->get_id(ike_sa);
421 if (id->is_initiator(id))
422 {
423 b->add_kv(b, "initiator", "yes");
424 }
425 b->add_kv(b, "initiator-spi", "%.16"PRIx64,
426 be64toh(id->get_initiator_spi(id)));
427 b->add_kv(b, "responder-spi", "%.16"PRIx64,
428 be64toh(id->get_responder_spi(id)));
429
430 add_condition(b, ike_sa, "nat-local", COND_NAT_HERE);
431 add_condition(b, ike_sa, "nat-remote", COND_NAT_THERE);
432 add_condition(b, ike_sa, "nat-fake", COND_NAT_FAKE);
433 add_condition(b, ike_sa, "nat-any", COND_NAT_ANY);
434
435 if_id = ike_sa->get_if_id(ike_sa, TRUE);
436 if (if_id)
437 {
438 b->add_kv(b, "if-id-in", "%.8x", if_id);
439 }
440 if_id = ike_sa->get_if_id(ike_sa, FALSE);
441 if (if_id)
442 {
443 b->add_kv(b, "if-id-out", "%.8x", if_id);
444 }
445
446 proposal = ike_sa->get_proposal(ike_sa);
447 if (proposal)
448 {
449 if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &ks))
450 {
451 b->add_kv(b, "encr-alg", "%N", encryption_algorithm_names, alg);
452 if (ks)
453 {
454 b->add_kv(b, "encr-keysize", "%u", ks);
455 }
456 }
457 if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, &ks))
458 {
459 b->add_kv(b, "integ-alg", "%N", integrity_algorithm_names, alg);
460 if (ks)
461 {
462 b->add_kv(b, "integ-keysize", "%u", ks);
463 }
464 }
465 if (proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL))
466 {
467 b->add_kv(b, "prf-alg", "%N", pseudo_random_function_names, alg);
468 }
469 if (proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP, &alg, NULL))
470 {
471 b->add_kv(b, "dh-group", "%N", diffie_hellman_group_names, alg);
472 }
473 }
474 add_condition(b, ike_sa, "ppk", COND_PPK);
475
476 if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED)
477 {
478 t = ike_sa->get_statistic(ike_sa, STAT_ESTABLISHED);
479 b->add_kv(b, "established", "%"PRId64, (int64_t)(now - t));
480 t = ike_sa->get_statistic(ike_sa, STAT_REKEY);
481 if (t)
482 {
483 b->add_kv(b, "rekey-time", "%"PRId64, (int64_t)(t - now));
484 }
485 t = ike_sa->get_statistic(ike_sa, STAT_REAUTH);
486 if (t)
487 {
488 b->add_kv(b, "reauth-time", "%"PRId64, (int64_t)(t - now));
489 }
490 }
491
492 list_vips(this, b, ike_sa, TRUE, "local-vips");
493 list_vips(this, b, ike_sa, FALSE, "remote-vips");
494
495 list_task_queue(this, b, ike_sa, TASK_QUEUE_QUEUED, "tasks-queued");
496 list_task_queue(this, b, ike_sa, TASK_QUEUE_ACTIVE, "tasks-active");
497 list_task_queue(this, b, ike_sa, TASK_QUEUE_PASSIVE, "tasks-passive");
498 }
499
500 CALLBACK(list_sas, vici_message_t*,
501 private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
502 {
503 vici_builder_t *b;
504 enumerator_t *isas, *csas;
505 ike_sa_t *ike_sa;
506 child_sa_t *child_sa;
507 time_t now;
508 char *ike;
509 u_int ike_id;
510 bool bl;
511 char buf[BUF_LEN];
512
513 bl = request->get_str(request, NULL, "noblock") == NULL;
514 ike = request->get_str(request, NULL, "ike");
515 ike_id = request->get_int(request, 0, "ike-id");
516
517 isas = charon->controller->create_ike_sa_enumerator(charon->controller, bl);
518 while (isas->enumerate(isas, &ike_sa))
519 {
520 if (ike && !streq(ike, ike_sa->get_name(ike_sa)))
521 {
522 continue;
523 }
524 if (ike_id && ike_id != ike_sa->get_unique_id(ike_sa))
525 {
526 continue;
527 }
528
529 now = time_monotonic(NULL);
530
531 b = vici_builder_create();
532 b->begin_section(b, ike_sa->get_name(ike_sa));
533
534 list_ike(this, b, ike_sa, now);
535
536 b->begin_section(b, "child-sas");
537 csas = ike_sa->create_child_sa_enumerator(ike_sa);
538 while (csas->enumerate(csas, &child_sa))
539 {
540 snprintf(buf, sizeof(buf), "%s-%u", child_sa->get_name(child_sa),
541 child_sa->get_unique_id(child_sa));
542 b->begin_section(b, buf);
543 list_child(this, b, child_sa, now);
544 b->end_section(b);
545 }
546 csas->destroy(csas);
547 b->end_section(b /* child-sas */ );
548
549 b->end_section(b);
550
551 this->dispatcher->raise_event(this->dispatcher, "list-sa", id,
552 b->finalize(b));
553 }
554 isas->destroy(isas);
555
556 b = vici_builder_create();
557 return b->finalize(b);
558 }
559
560 /**
561 * Raise a list-policy event for given CHILD_SA
562 */
563 static void raise_policy(private_vici_query_t *this, u_int id, char *ike,
564 child_sa_t *child)
565 {
566 enumerator_t *enumerator;
567 traffic_selector_t *ts;
568 vici_builder_t *b;
569 char buf[BUF_LEN];
570
571 b = vici_builder_create();
572 snprintf(buf, sizeof(buf), "%s/%s", ike, child->get_name(child));
573 b->begin_section(b, buf);
574 b->add_kv(b, "child", "%s", child->get_name(child));
575 b->add_kv(b, "ike", "%s", ike);
576
577 list_mode(b, child, NULL);
578
579 b->begin_list(b, "local-ts");
580 enumerator = child->create_ts_enumerator(child, TRUE);
581 while (enumerator->enumerate(enumerator, &ts))
582 {
583 b->add_li(b, "%R", ts);
584 }
585 enumerator->destroy(enumerator);
586 b->end_list(b /* local-ts */);
587
588 b->begin_list(b, "remote-ts");
589 enumerator = child->create_ts_enumerator(child, FALSE);
590 while (enumerator->enumerate(enumerator, &ts))
591 {
592 b->add_li(b, "%R", ts);
593 }
594 enumerator->destroy(enumerator);
595 b->end_list(b /* remote-ts */);
596
597 b->end_section(b);
598
599 this->dispatcher->raise_event(this->dispatcher, "list-policy", id,
600 b->finalize(b));
601 }
602
603 /**
604 * Raise a list-policy event for given CHILD_SA config
605 */
606 static void raise_policy_cfg(private_vici_query_t *this, u_int id, char *ike,
607 child_cfg_t *cfg)
608 {
609 enumerator_t *enumerator;
610 linked_list_t *list;
611 traffic_selector_t *ts;
612 vici_builder_t *b;
613 char buf[BUF_LEN];
614
615 b = vici_builder_create();
616 snprintf(buf, sizeof(buf), "%s%s%s", ike ? ike : "", ike ? "/" : "",
617 cfg->get_name(cfg));
618 b->begin_section(b, buf);
619 b->add_kv(b, "child", "%s", cfg->get_name(cfg));
620 if (ike)
621 {
622 b->add_kv(b, "ike", "%s", ike);
623 }
624
625 list_mode(b, NULL, cfg);
626
627 b->begin_list(b, "local-ts");
628 list = cfg->get_traffic_selectors(cfg, TRUE, NULL, NULL, FALSE);
629 enumerator = list->create_enumerator(list);
630 while (enumerator->enumerate(enumerator, &ts))
631 {
632 b->add_li(b, "%R", ts);
633 }
634 enumerator->destroy(enumerator);
635 list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
636 b->end_list(b /* local-ts */);
637
638 b->begin_list(b, "remote-ts");
639 list = cfg->get_traffic_selectors(cfg, FALSE, NULL, NULL, FALSE);
640 enumerator = list->create_enumerator(list);
641 while (enumerator->enumerate(enumerator, &ts))
642 {
643 b->add_li(b, "%R", ts);
644 }
645 enumerator->destroy(enumerator);
646 list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
647 b->end_list(b /* remote-ts */);
648
649 b->end_section(b);
650
651 this->dispatcher->raise_event(this->dispatcher, "list-policy", id,
652 b->finalize(b));
653 }
654
655 CALLBACK(list_policies, vici_message_t*,
656 private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
657 {
658 enumerator_t *enumerator;
659 vici_builder_t *b;
660 child_sa_t *child_sa;
661 peer_cfg_t *peer_cfg;
662 child_cfg_t *child_cfg;
663 bool drop, pass, trap;
664 char *child, *ike, *ns;
665
666 drop = request->get_str(request, NULL, "drop") != NULL;
667 pass = request->get_str(request, NULL, "pass") != NULL;
668 trap = request->get_str(request, NULL, "trap") != NULL;
669 child = request->get_str(request, NULL, "child");
670 ike = request->get_str(request, NULL, "ike");
671
672 if (trap)
673 {
674 enumerator = charon->traps->create_enumerator(charon->traps);
675 while (enumerator->enumerate(enumerator, &peer_cfg, &child_sa))
676 {
677 if ((ike && !streq(ike, peer_cfg->get_name(peer_cfg))) ||
678 (child && !streq(child, child_sa->get_name(child_sa))))
679 {
680 continue;
681 }
682 raise_policy(this, id, peer_cfg->get_name(peer_cfg), child_sa);
683 }
684 enumerator->destroy(enumerator);
685 }
686
687 if (drop || pass)
688 {
689 enumerator = charon->shunts->create_enumerator(charon->shunts);
690 while (enumerator->enumerate(enumerator, &ns, &child_cfg))
691 {
692 if ((ike && !streq(ike, ns)) ||
693 (child && !streq(child, child_cfg->get_name(child_cfg))))
694 {
695 continue;
696 }
697 switch (child_cfg->get_mode(child_cfg))
698 {
699 case MODE_DROP:
700 if (drop)
701 {
702 raise_policy_cfg(this, id, ns, child_cfg);
703 }
704 break;
705 case MODE_PASS:
706 if (pass)
707 {
708 raise_policy_cfg(this, id, ns, child_cfg);
709 }
710 break;
711 default:
712 break;
713 }
714 }
715 enumerator->destroy(enumerator);
716 }
717
718 b = vici_builder_create();
719 return b->finalize(b);
720 }
721
722 /**
723 * Build sections for auth configs, local or remote
724 */
725 static void build_auth_cfgs(peer_cfg_t *peer_cfg, bool local, vici_builder_t *b)
726 {
727 enumerator_t *enumerator, *rules;
728 auth_rule_t rule;
729 auth_cfg_t *auth;
730 union {
731 uintptr_t u;
732 identification_t *id;
733 certificate_t *cert;
734 char *str;
735 } v;
736 char buf[32];
737 int i = 0;
738
739 enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, local);
740 while (enumerator->enumerate(enumerator, &auth))
741 {
742 snprintf(buf, sizeof(buf), "%s-%d", local ? "local" : "remote", ++i);
743 b->begin_section(b, buf);
744
745 rules = auth->create_enumerator(auth);
746 while (rules->enumerate(rules, &rule, &v))
747 {
748 switch (rule)
749 {
750 case AUTH_RULE_AUTH_CLASS:
751 b->add_kv(b, "class", "%N", auth_class_names, v.u);
752 break;
753 case AUTH_RULE_EAP_TYPE:
754 b->add_kv(b, "eap-type", "%N", eap_type_names, v.u);
755 break;
756 case AUTH_RULE_EAP_VENDOR:
757 b->add_kv(b, "eap-vendor", "%u", v.u);
758 break;
759 case AUTH_RULE_XAUTH_BACKEND:
760 b->add_kv(b, "xauth", "%s", v.str);
761 break;
762 case AUTH_RULE_CRL_VALIDATION:
763 b->add_kv(b, "revocation", "%N", cert_validation_names, v.u);
764 break;
765 case AUTH_RULE_IDENTITY:
766 b->add_kv(b, "id", "%Y", v.id);
767 break;
768 case AUTH_RULE_AAA_IDENTITY:
769 b->add_kv(b, "aaa_id", "%Y", v.id);
770 break;
771 case AUTH_RULE_EAP_IDENTITY:
772 b->add_kv(b, "eap_id", "%Y", v.id);
773 break;
774 case AUTH_RULE_XAUTH_IDENTITY:
775 b->add_kv(b, "xauth_id", "%Y", v.id);
776 break;
777 default:
778 break;
779 }
780 }
781 rules->destroy(rules);
782
783 b->begin_list(b, "groups");
784 rules = auth->create_enumerator(auth);
785 while (rules->enumerate(rules, &rule, &v))
786 {
787 if (rule == AUTH_RULE_GROUP)
788 {
789 b->add_li(b, "%Y", v.id);
790 }
791 }
792 rules->destroy(rules);
793 b->end_list(b);
794
795 b->begin_list(b, "cert_policy");
796 rules = auth->create_enumerator(auth);
797 while (rules->enumerate(rules, &rule, &v))
798 {
799 if (rule == AUTH_RULE_CERT_POLICY)
800 {
801 b->add_li(b, "%s", v.str);
802 }
803 }
804 rules->destroy(rules);
805 b->end_list(b);
806
807 b->begin_list(b, "certs");
808 rules = auth->create_enumerator(auth);
809 while (rules->enumerate(rules, &rule, &v))
810 {
811 if (rule == AUTH_RULE_SUBJECT_CERT)
812 {
813 b->add_li(b, "%Y", v.cert->get_subject(v.cert));
814 }
815 }
816 rules->destroy(rules);
817 b->end_list(b);
818
819 b->begin_list(b, "cacerts");
820 rules = auth->create_enumerator(auth);
821 while (rules->enumerate(rules, &rule, &v))
822 {
823 if (rule == AUTH_RULE_CA_CERT)
824 {
825 b->add_li(b, "%Y", v.cert->get_subject(v.cert));
826 }
827 }
828 rules->destroy(rules);
829 b->end_list(b);
830
831 b->end_section(b);
832 }
833 enumerator->destroy(enumerator);
834 }
835
836 CALLBACK(list_conns, vici_message_t*,
837 private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
838 {
839 enumerator_t *enumerator, *tokens, *selectors, *children;
840 peer_cfg_t *peer_cfg;
841 ike_cfg_t *ike_cfg;
842 child_cfg_t *child_cfg;
843 char *ike, *str, *interface;
844 uint32_t manual_prio, dpd_delay, dpd_timeout;
845 identification_t *ppk_id;
846 linked_list_t *list;
847 traffic_selector_t *ts;
848 lifetime_cfg_t *lft;
849 vici_builder_t *b;
850
851 ike = request->get_str(request, NULL, "ike");
852
853 enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends,
854 NULL, NULL, NULL, NULL, IKE_ANY);
855 while (enumerator->enumerate(enumerator, &peer_cfg))
856 {
857 if (ike && !streq(ike, peer_cfg->get_name(peer_cfg)))
858 {
859 continue;
860 }
861
862 b = vici_builder_create();
863 b->begin_section(b, peer_cfg->get_name(peer_cfg));
864
865 ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
866
867 b->begin_list(b, "local_addrs");
868 str = ike_cfg->get_my_addr(ike_cfg);
869 tokens = enumerator_create_token(str, ",", " ");
870 while (tokens->enumerate(tokens, &str))
871 {
872 b->add_li(b, "%s", str);
873 }
874 tokens->destroy(tokens);
875 b->end_list(b);
876
877 b->begin_list(b, "remote_addrs");
878 str = ike_cfg->get_other_addr(ike_cfg);
879 tokens = enumerator_create_token(str, ",", " ");
880 while (tokens->enumerate(tokens, &str))
881 {
882 b->add_li(b, "%s", str);
883 }
884 tokens->destroy(tokens);
885 b->end_list(b);
886
887 b->add_kv(b, "version", "%N", ike_version_names,
888 peer_cfg->get_ike_version(peer_cfg));
889 b->add_kv(b, "reauth_time", "%u",
890 peer_cfg->get_reauth_time(peer_cfg, FALSE));
891 b->add_kv(b, "rekey_time", "%u",
892 peer_cfg->get_rekey_time(peer_cfg, FALSE));
893 b->add_kv(b, "unique", "%N", unique_policy_names,
894 peer_cfg->get_unique_policy(peer_cfg));
895
896 dpd_delay = peer_cfg->get_dpd(peer_cfg);
897 if (dpd_delay)
898 {
899 b->add_kv(b, "dpd_delay", "%u", dpd_delay);
900 }
901
902 dpd_timeout = peer_cfg->get_dpd_timeout(peer_cfg);
903 if (dpd_timeout)
904 {
905 b->add_kv(b, "dpd_timeout", "%u", dpd_timeout);
906 }
907
908 ppk_id = peer_cfg->get_ppk_id(peer_cfg);
909 if (ppk_id)
910 {
911 b->add_kv(b, "ppk_id", "%Y", ppk_id);
912 }
913 if (peer_cfg->ppk_required(peer_cfg))
914 {
915 b->add_kv(b, "ppk_required", "yes");
916 }
917
918 build_auth_cfgs(peer_cfg, TRUE, b);
919 build_auth_cfgs(peer_cfg, FALSE, b);
920
921 b->begin_section(b, "children");
922
923 children = peer_cfg->create_child_cfg_enumerator(peer_cfg);
924 while (children->enumerate(children, &child_cfg))
925 {
926 b->begin_section(b, child_cfg->get_name(child_cfg));
927
928 list_mode(b, NULL, child_cfg);
929
930 lft = child_cfg->get_lifetime(child_cfg, FALSE);
931 b->add_kv(b, "rekey_time", "%"PRIu64, lft->time.rekey);
932 b->add_kv(b, "rekey_bytes", "%"PRIu64, lft->bytes.rekey);
933 b->add_kv(b, "rekey_packets", "%"PRIu64, lft->packets.rekey);
934 free(lft);
935
936 b->add_kv(b, "dpd_action", "%N", action_names,
937 child_cfg->get_dpd_action(child_cfg));
938 b->add_kv(b, "close_action", "%N", action_names,
939 child_cfg->get_close_action(child_cfg));
940
941 b->begin_list(b, "local-ts");
942 list = child_cfg->get_traffic_selectors(child_cfg, TRUE, NULL,
943 NULL, FALSE);
944 selectors = list->create_enumerator(list);
945 while (selectors->enumerate(selectors, &ts))
946 {
947 b->add_li(b, "%R", ts);
948 }
949 selectors->destroy(selectors);
950 list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
951 b->end_list(b /* local-ts */);
952
953 b->begin_list(b, "remote-ts");
954 list = child_cfg->get_traffic_selectors(child_cfg, FALSE, NULL,
955 NULL, FALSE);
956 selectors = list->create_enumerator(list);
957 while (selectors->enumerate(selectors, &ts))
958 {
959 b->add_li(b, "%R", ts);
960 }
961 selectors->destroy(selectors);
962 list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
963 b->end_list(b /* remote-ts */);
964
965 interface = child_cfg->get_interface(child_cfg);
966 if (interface)
967 {
968 b->add_kv(b, "interface", "%s", interface);
969 }
970
971 manual_prio = child_cfg->get_manual_prio(child_cfg);
972 if (manual_prio)
973 {
974 b->add_kv(b, "priority", "%u", manual_prio);
975 }
976
977 b->end_section(b);
978 }
979 children->destroy(children);
980
981 b->end_section(b); /* children */
982
983 b->end_section(b); /* name */
984
985 this->dispatcher->raise_event(this->dispatcher, "list-conn", id,
986 b->finalize(b));
987 }
988 enumerator->destroy(enumerator);
989
990 b = vici_builder_create();
991 return b->finalize(b);
992 }
993
994 /**
995 * Do we have a private key for given certificate
996 */
997 static bool has_privkey(certificate_t *cert)
998 {
999 private_key_t *private;
1000 public_key_t *public;
1001 identification_t *keyid;
1002 chunk_t chunk;
1003 bool found = FALSE;
1004
1005 public = cert->get_public_key(cert);
1006 if (public)
1007 {
1008 if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &chunk))
1009 {
1010 keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
1011 private = lib->credmgr->get_private(lib->credmgr,
1012 public->get_type(public), keyid, NULL);
1013 if (private)
1014 {
1015 found = TRUE;
1016 private->destroy(private);
1017 }
1018 keyid->destroy(keyid);
1019 }
1020 public->destroy(public);
1021 }
1022 return found;
1023 }
1024
1025 /**
1026 * Store cert filter data
1027 */
1028 typedef struct {
1029 certificate_type_t type;
1030 x509_flag_t flag;
1031 identification_t *subject;
1032 } cert_filter_t;
1033
1034 /**
1035 * Enumerate all X.509 certificates with a given flag
1036 */
1037 static void enum_x509(private_vici_query_t *this, u_int id,
1038 linked_list_t *certs, cert_filter_t *filter,
1039 x509_flag_t flag)
1040 {
1041 enumerator_t *enumerator;
1042 certificate_t *cert;
1043 vici_builder_t *b;
1044 chunk_t encoding;
1045 x509_t *x509;
1046
1047 if (filter->type != CERT_ANY && filter->flag != X509_ANY &&
1048 filter->flag != flag)
1049 {
1050 return;
1051 }
1052
1053 enumerator = certs->create_enumerator(certs);
1054 while (enumerator->enumerate(enumerator, &cert))
1055 {
1056 x509 = (x509_t*)cert;
1057 if ((x509->get_flags(x509) & X509_ANY) != flag)
1058 {
1059 continue;
1060 }
1061
1062 if (cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
1063 {
1064 b = vici_builder_create();
1065 b->add_kv(b, "type", "%N", certificate_type_names, CERT_X509);
1066 b->add_kv(b, "flag", "%N", x509_flag_names, flag);
1067 if (has_privkey(cert))
1068 {
1069 b->add_kv(b, "has_privkey", "yes");
1070 }
1071 b->add(b, VICI_KEY_VALUE, "data", encoding);
1072 free(encoding.ptr);
1073
1074 this->dispatcher->raise_event(this->dispatcher, "list-cert", id,
1075 b->finalize(b));
1076 }
1077 }
1078 enumerator->destroy(enumerator);
1079 }
1080
1081 /**
1082 * Enumerate all non-X.509 certificate types
1083 */
1084 static void enum_others(private_vici_query_t *this, u_int id,
1085 linked_list_t *certs, certificate_type_t type)
1086 {
1087 enumerator_t *enumerator;
1088 certificate_t *cert;
1089 vici_builder_t *b;
1090 chunk_t encoding, t_ch;
1091 cred_encoding_type_t encoding_type;
1092 identification_t *subject;
1093 time_t not_before, not_after;
1094
1095 encoding_type = (type == CERT_TRUSTED_PUBKEY) ? PUBKEY_SPKI_ASN1_DER :
1096 CERT_ASN1_DER;
1097
1098 enumerator = certs->create_enumerator(certs);
1099 while (enumerator->enumerate(enumerator, &cert))
1100 {
1101 if (cert->get_encoding(cert, encoding_type, &encoding))
1102 {
1103 b = vici_builder_create();
1104 b->add_kv(b, "type", "%N", certificate_type_names, type);
1105 if (has_privkey(cert))
1106 {
1107 b->add_kv(b, "has_privkey", "yes");
1108 }
1109 b->add(b, VICI_KEY_VALUE, "data", encoding);
1110 free(encoding.ptr);
1111
1112 if (type == CERT_TRUSTED_PUBKEY)
1113 {
1114 subject = cert->get_subject(cert);
1115 if (subject->get_type(subject) != ID_KEY_ID)
1116 {
1117 b->add_kv(b, "subject", "%Y", cert->get_subject(cert));
1118 }
1119 cert->get_validity(cert, NULL, &not_before, &not_after);
1120 if (not_before != UNDEFINED_TIME)
1121 {
1122 t_ch = asn1_from_time(&not_before, ASN1_GENERALIZEDTIME);
1123 b->add(b, VICI_KEY_VALUE, "not-before", chunk_skip(t_ch, 2));
1124 chunk_free(&t_ch);
1125 }
1126 if (not_after != UNDEFINED_TIME)
1127 {
1128 t_ch = asn1_from_time(&not_after, ASN1_GENERALIZEDTIME);
1129 b->add(b, VICI_KEY_VALUE, "not-after", chunk_skip(t_ch, 2));
1130 chunk_free(&t_ch);
1131 }
1132 }
1133 this->dispatcher->raise_event(this->dispatcher, "list-cert", id,
1134 b->finalize(b));
1135 }
1136 }
1137 enumerator->destroy(enumerator);
1138 }
1139
1140 /**
1141 * Enumerate all certificates of a given type
1142 */
1143 static void enum_certs(private_vici_query_t *this, u_int id,
1144 cert_filter_t *filter, certificate_type_t type)
1145 {
1146 enumerator_t *e1, *e2;
1147 certificate_t *cert, *current;
1148 linked_list_t *certs;
1149 bool found;
1150
1151 if (filter->type != CERT_ANY && filter->type != type)
1152 {
1153 return;
1154 }
1155 certs = linked_list_create();
1156
1157 e1 = lib->credmgr->create_cert_enumerator(lib->credmgr, type, KEY_ANY,
1158 filter->subject, FALSE);
1159 while (e1->enumerate(e1, &cert))
1160 {
1161 found = FALSE;
1162
1163 e2 = certs->create_enumerator(certs);
1164 while (e2->enumerate(e2, &current))
1165 {
1166 if (current->equals(current, cert))
1167 {
1168 found = TRUE;
1169 break;
1170 }
1171 }
1172 e2->destroy(e2);
1173
1174 if (!found)
1175 {
1176 certs->insert_last(certs, cert->get_ref(cert));
1177 }
1178 }
1179 e1->destroy(e1);
1180
1181 if (type == CERT_X509)
1182 {
1183 enum_x509(this, id, certs, filter, X509_NONE);
1184 enum_x509(this, id, certs, filter, X509_CA);
1185 enum_x509(this, id, certs, filter, X509_AA);
1186 enum_x509(this, id, certs, filter, X509_OCSP_SIGNER);
1187 }
1188 else
1189 {
1190 enum_others(this, id, certs, type);
1191 }
1192 certs->destroy_offset(certs, offsetof(certificate_t, destroy));
1193 }
1194
1195 CALLBACK(list_certs, vici_message_t*,
1196 private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
1197 {
1198 cert_filter_t filter = {
1199 .type = CERT_ANY,
1200 .flag = X509_ANY,
1201 .subject = NULL
1202 };
1203 vici_builder_t *b;
1204 char *str;
1205
1206 str = request->get_str(request, "ANY", "type");
1207 if (enum_from_name(certificate_type_names, str, &filter.type))
1208 {
1209 if (filter.type == CERT_X509)
1210 {
1211 str = request->get_str(request, "ANY", "flag");
1212 if (!enum_from_name(x509_flag_names, str, &filter.flag))
1213 {
1214 DBG1(DBG_CFG, "invalid certificate flag '%s'", str);
1215 goto finalize;
1216 }
1217 }
1218 }
1219 else if (!vici_cert_info_from_str(str, &filter.type, &filter.flag))
1220 {
1221 DBG1(DBG_CFG, "invalid certificate type '%s'", str);
1222 goto finalize;
1223 }
1224
1225 str = request->get_str(request, NULL, "subject");
1226 if (str)
1227 {
1228 filter.subject = identification_create_from_string(str);
1229 }
1230
1231 enum_certs(this, id, &filter, CERT_TRUSTED_PUBKEY);
1232 enum_certs(this, id, &filter, CERT_X509);
1233 enum_certs(this, id, &filter, CERT_X509_AC);
1234 enum_certs(this, id, &filter, CERT_X509_CRL);
1235 enum_certs(this, id, &filter, CERT_X509_OCSP_RESPONSE);
1236 DESTROY_IF(filter.subject);
1237
1238 finalize:
1239 b = vici_builder_create();
1240 return b->finalize(b);
1241 }
1242
1243 /**
1244 * Add a key/value pair of ALG => plugin
1245 */
1246 static void add_algorithm(vici_builder_t *b, enum_name_t *alg_names,
1247 int alg_type, const char *plugin_name)
1248 {
1249 char alg_name[BUF_LEN];
1250
1251 sprintf(alg_name, "%N", alg_names, alg_type);
1252 b->add_kv(b, alg_name, (char*)plugin_name);
1253 }
1254
1255 CALLBACK(get_algorithms, vici_message_t*,
1256 private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
1257 {
1258 vici_builder_t *b;
1259 enumerator_t *enumerator;
1260 encryption_algorithm_t encryption;
1261 integrity_algorithm_t integrity;
1262 hash_algorithm_t hash;
1263 pseudo_random_function_t prf;
1264 ext_out_function_t xof;
1265 drbg_type_t drbg;
1266 diffie_hellman_group_t group;
1267 rng_quality_t quality;
1268 const char *plugin_name;
1269
1270 b = vici_builder_create();
1271
1272 b->begin_section(b, "encryption");
1273 enumerator = lib->crypto->create_crypter_enumerator(lib->crypto);
1274 while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
1275 {
1276 add_algorithm(b, encryption_algorithm_names, encryption, plugin_name);
1277 }
1278 enumerator->destroy(enumerator);
1279 b->end_section(b);
1280
1281 b->begin_section(b, "integrity");
1282 enumerator = lib->crypto->create_signer_enumerator(lib->crypto);
1283 while (enumerator->enumerate(enumerator, &integrity, &plugin_name))
1284 {
1285 add_algorithm(b, integrity_algorithm_names, integrity, plugin_name);
1286 }
1287 enumerator->destroy(enumerator);
1288 b->end_section(b);
1289
1290 b->begin_section(b, "aead");
1291 enumerator = lib->crypto->create_aead_enumerator(lib->crypto);
1292 while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
1293 {
1294 add_algorithm(b, encryption_algorithm_names, encryption, plugin_name);
1295 }
1296 enumerator->destroy(enumerator);
1297 b->end_section(b);
1298
1299 b->begin_section(b, "hasher");
1300 enumerator = lib->crypto->create_hasher_enumerator(lib->crypto);
1301 while (enumerator->enumerate(enumerator, &hash, &plugin_name))
1302 {
1303 add_algorithm(b, hash_algorithm_names, hash, plugin_name);
1304 }
1305 enumerator->destroy(enumerator);
1306 b->end_section(b);
1307
1308 b->begin_section(b, "prf");
1309 enumerator = lib->crypto->create_prf_enumerator(lib->crypto);
1310 while (enumerator->enumerate(enumerator, &prf, &plugin_name))
1311 {
1312 add_algorithm(b, pseudo_random_function_names, prf, plugin_name);
1313 }
1314 enumerator->destroy(enumerator);
1315 b->end_section(b);
1316
1317 b->begin_section(b, "xof");
1318 enumerator = lib->crypto->create_xof_enumerator(lib->crypto);
1319 while (enumerator->enumerate(enumerator, &xof, &plugin_name))
1320 {
1321 add_algorithm(b, ext_out_function_names, xof, plugin_name);
1322 }
1323 enumerator->destroy(enumerator);
1324 b->end_section(b);
1325
1326 b->begin_section(b, "drbg");
1327 enumerator = lib->crypto->create_drbg_enumerator(lib->crypto);
1328 while (enumerator->enumerate(enumerator, &drbg, &plugin_name))
1329 {
1330 add_algorithm(b, drbg_type_names, drbg, plugin_name);
1331 }
1332 enumerator->destroy(enumerator);
1333 b->end_section(b);
1334
1335 b->begin_section(b, "dh");
1336 enumerator = lib->crypto->create_dh_enumerator(lib->crypto);
1337 while (enumerator->enumerate(enumerator, &group, &plugin_name))
1338 {
1339 add_algorithm(b, diffie_hellman_group_names, group, plugin_name);
1340 }
1341 enumerator->destroy(enumerator);
1342 b->end_section(b);
1343
1344 b->begin_section(b, "rng");
1345 enumerator = lib->crypto->create_rng_enumerator(lib->crypto);
1346 while (enumerator->enumerate(enumerator, &quality, &plugin_name))
1347 {
1348 add_algorithm(b, rng_quality_names, quality, plugin_name);
1349 }
1350 enumerator->destroy(enumerator);
1351 b->end_section(b);
1352
1353 b->begin_section(b, "nonce-gen");
1354 enumerator = lib->crypto->create_nonce_gen_enumerator(lib->crypto);
1355 while (enumerator->enumerate(enumerator, &plugin_name))
1356 {
1357 b->add_kv(b, "NONCE_GEN", (char*)plugin_name);
1358 }
1359 enumerator->destroy(enumerator);
1360 b->end_section(b);
1361
1362 return b->finalize(b);
1363 }
1364
1365 /**
1366 * Make sure we have the counters query interface
1367 */
1368 static inline bool ensure_counters(private_vici_query_t *this)
1369 {
1370 if (this->counters)
1371 {
1372 return TRUE;
1373 }
1374 return (this->counters = lib->get(lib, "counters")) != NULL;
1375 }
1376
1377 /**
1378 * Add a single set of counters to the message
1379 *
1380 * Frees the array of counter values
1381 */
1382 static void add_counters(vici_builder_t *b, char *name, uint64_t *counters)
1383 {
1384 char buf[BUF_LEN];
1385 counter_type_t i;
1386
1387 b->begin_section(b, name ?: "");
1388 for (i = 0; i < COUNTER_MAX; i++)
1389 {
1390 snprintf(buf, sizeof(buf), "%N", vici_counter_type_names, i);
1391 b->add_kv(b, buf, "%"PRIu64, counters[i]);
1392 }
1393 b->end_section(b);
1394 free(counters);
1395 }
1396
1397 CALLBACK(get_counters, vici_message_t*,
1398 private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
1399 {
1400 vici_builder_t *b;
1401 enumerator_t *enumerator;
1402 uint64_t *counters;
1403 char *conn, *errmsg = NULL;
1404 bool all;
1405
1406 b = vici_builder_create();
1407
1408 if (ensure_counters(this))
1409 {
1410 conn = request->get_str(request, NULL, "name");
1411 all = request->get_bool(request, FALSE, "all");
1412
1413 b->begin_section(b, "counters");
1414 if (all)
1415 {
1416 enumerator = this->counters->get_names(this->counters);
1417 while (enumerator->enumerate(enumerator, &conn))
1418 {
1419 counters = this->counters->get_all(this->counters, conn);
1420 if (counters)
1421 {
1422 add_counters(b, conn, counters);
1423 }
1424 }
1425 enumerator->destroy(enumerator);
1426 }
1427 else
1428 {
1429 counters = this->counters->get_all(this->counters, conn);
1430 if (counters)
1431 {
1432 add_counters(b, conn, counters);
1433 }
1434 else
1435 {
1436 errmsg = "no counters found for this connection";
1437 }
1438 }
1439 b->end_section(b);
1440 }
1441 else
1442 {
1443 errmsg = "no counters available (plugin missing?)";
1444 }
1445
1446 b->add_kv(b, "success", errmsg ? "no" : "yes");
1447 if (errmsg)
1448 {
1449 b->add_kv(b, "errmsg", "%s", errmsg);
1450 }
1451 return b->finalize(b);
1452 }
1453
1454 CALLBACK(reset_counters, vici_message_t*,
1455 private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
1456 {
1457 vici_builder_t *b;
1458 char *conn, *errmsg = NULL;
1459 bool all;
1460
1461 b = vici_builder_create();
1462
1463 if (ensure_counters(this))
1464 {
1465 conn = request->get_str(request, NULL, "name");
1466 all = request->get_bool(request, FALSE, "all");
1467
1468 if (all)
1469 {
1470 this->counters->reset_all(this->counters);
1471 }
1472 else
1473 {
1474 this->counters->reset(this->counters, conn);
1475 }
1476 }
1477 else
1478 {
1479 errmsg = "no counters available (plugin missing?)";
1480 }
1481
1482 b->add_kv(b, "success", errmsg ? "no" : "yes");
1483 if (errmsg)
1484 {
1485 b->add_kv(b, "errmsg", "%s", errmsg);
1486 }
1487 return b->finalize(b);
1488 }
1489
1490 CALLBACK(version, vici_message_t*,
1491 private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
1492 {
1493 vici_builder_t *b;
1494
1495 b = vici_builder_create();
1496 b->add_kv(b, "daemon", "%s", lib->ns);
1497 b->add_kv(b, "version", "%s", VERSION);
1498
1499 #ifdef WIN32
1500 {
1501 OSVERSIONINFOEX osvie;
1502
1503 memset(&osvie, 0, sizeof(osvie));
1504 osvie.dwOSVersionInfoSize = sizeof(osvie);
1505
1506 if (GetVersionEx((LPOSVERSIONINFO)&osvie))
1507 {
1508 b->add_kv(b, "sysname", "Windows %s",
1509 osvie.wProductType == VER_NT_WORKSTATION ? "Client" : "Server");
1510 b->add_kv(b, "release", "%d.%d.%d (SP %d.%d)",
1511 osvie.dwMajorVersion, osvie.dwMinorVersion, osvie.dwBuildNumber,
1512 osvie.wServicePackMajor, osvie.wServicePackMinor);
1513 b->add_kv(b, "machine", "%s",
1514 #ifdef WIN64
1515 "x86_64");
1516 #else
1517 "x86");
1518 #endif /* !WIN64 */
1519 }
1520 }
1521 #else /* !WIN32 */
1522 {
1523 struct utsname utsname;
1524
1525 if (uname(&utsname) == 0)
1526 {
1527 b->add_kv(b, "sysname", "%s", utsname.sysname);
1528 b->add_kv(b, "release", "%s", utsname.release);
1529 b->add_kv(b, "machine", "%s", utsname.machine);
1530 }
1531 }
1532 #endif /* !WIN32 */
1533 return b->finalize(b);
1534 }
1535
1536 CALLBACK(stats, vici_message_t*,
1537 private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
1538 {
1539 vici_builder_t *b;
1540 enumerator_t *enumerator;
1541 plugin_t *plugin;
1542 time_t since, now;
1543 int i;
1544
1545 b = vici_builder_create();
1546
1547 now = time_monotonic(NULL);
1548 since = time(NULL) - (now - this->uptime);
1549
1550 b->begin_section(b, "uptime");
1551 b->add_kv(b, "running", "%V", &now, &this->uptime);
1552 b->add_kv(b, "since", "%T", &since, FALSE);
1553 b->end_section(b);
1554
1555 b->begin_section(b, "workers");
1556 b->add_kv(b, "total", "%d",
1557 lib->processor->get_total_threads(lib->processor));
1558 b->add_kv(b, "idle", "%d",
1559 lib->processor->get_idle_threads(lib->processor));
1560 b->begin_section(b, "active");
1561 for (i = 0; i < JOB_PRIO_MAX; i++)
1562 {
1563 b->add_kv(b, enum_to_name(job_priority_names, i), "%d",
1564 lib->processor->get_working_threads(lib->processor, i));
1565 }
1566 b->end_section(b);
1567 b->end_section(b);
1568
1569 b->begin_section(b, "queues");
1570 for (i = 0; i < JOB_PRIO_MAX; i++)
1571 {
1572 b->add_kv(b, enum_to_name(job_priority_names, i), "%d",
1573 lib->processor->get_job_load(lib->processor, i));
1574 }
1575 b->end_section(b);
1576
1577 b->add_kv(b, "scheduled", "%d",
1578 lib->scheduler->get_job_load(lib->scheduler));
1579
1580 b->begin_section(b, "ikesas");
1581 b->add_kv(b, "total", "%u",
1582 charon->ike_sa_manager->get_count(charon->ike_sa_manager));
1583 b->add_kv(b, "half-open", "%u",
1584 charon->ike_sa_manager->get_half_open_count(charon->ike_sa_manager,
1585 NULL, FALSE));
1586 b->end_section(b);
1587
1588 b->begin_list(b, "plugins");
1589 enumerator = lib->plugins->create_plugin_enumerator(lib->plugins);
1590 while (enumerator->enumerate(enumerator, &plugin, NULL))
1591 {
1592 b->add_li(b, "%s", plugin->get_name(plugin));
1593 }
1594 enumerator->destroy(enumerator);
1595 b->end_list(b);
1596
1597 #ifdef WIN32
1598 {
1599 DWORD lasterr = ERROR_INVALID_HANDLE;
1600 HANDLE heaps[32];
1601 int i, count;
1602 char buf[16];
1603 size_t total = 0;
1604 int allocs = 0;
1605
1606 b->begin_section(b, "mem");
1607 count = GetProcessHeaps(countof(heaps), heaps);
1608 for (i = 0; i < count; i++)
1609 {
1610 PROCESS_HEAP_ENTRY entry = {};
1611 size_t heap_total = 0;
1612 int heap_allocs = 0;
1613
1614 if (HeapLock(heaps[i]))
1615 {
1616 while (HeapWalk(heaps[i], &entry))
1617 {
1618 if (entry.wFlags & PROCESS_HEAP_ENTRY_BUSY)
1619 {
1620 heap_total += entry.cbData;
1621 heap_allocs++;
1622 }
1623 }
1624 lasterr = GetLastError();
1625 HeapUnlock(heaps[i]);
1626 }
1627 if (lasterr != ERROR_NO_MORE_ITEMS)
1628 {
1629 break;
1630 }
1631 snprintf(buf, sizeof(buf), "heap-%d", i);
1632 b->begin_section(b, buf);
1633 b->add_kv(b, "total", "%zu", heap_total);
1634 b->add_kv(b, "allocs", "%d", heap_allocs);
1635 b->end_section(b);
1636
1637 total += heap_total;
1638 allocs += heap_allocs;
1639 }
1640 if (lasterr == ERROR_NO_MORE_ITEMS)
1641 {
1642 b->add_kv(b, "total", "%zu", total);
1643 b->add_kv(b, "allocs", "%d", allocs);
1644 }
1645 b->end_section(b);
1646 }
1647 #endif
1648
1649 #ifdef HAVE_MALLINFO
1650 {
1651 struct mallinfo mi = mallinfo();
1652
1653 b->begin_section(b, "mallinfo");
1654 b->add_kv(b, "sbrk", "%u", mi.arena);
1655 b->add_kv(b, "mmap", "%u", mi.hblkhd);
1656 b->add_kv(b, "used", "%u", mi.uordblks);
1657 b->add_kv(b, "free", "%u", mi.fordblks);
1658 b->end_section(b);
1659 }
1660 #endif /* HAVE_MALLINFO */
1661
1662 return b->finalize(b);
1663 }
1664
1665 static void manage_command(private_vici_query_t *this,
1666 char *name, vici_command_cb_t cb, bool reg)
1667 {
1668 this->dispatcher->manage_command(this->dispatcher, name,
1669 reg ? cb : NULL, this);
1670 }
1671
1672 /**
1673 * (Un-)register dispatcher functions
1674 */
1675 static void manage_commands(private_vici_query_t *this, bool reg)
1676 {
1677 this->dispatcher->manage_event(this->dispatcher, "list-sa", reg);
1678 this->dispatcher->manage_event(this->dispatcher, "list-policy", reg);
1679 this->dispatcher->manage_event(this->dispatcher, "list-conn", reg);
1680 this->dispatcher->manage_event(this->dispatcher, "list-cert", reg);
1681 this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg);
1682 this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg);
1683 this->dispatcher->manage_event(this->dispatcher, "child-updown", reg);
1684 this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg);
1685 manage_command(this, "list-sas", list_sas, reg);
1686 manage_command(this, "list-policies", list_policies, reg);
1687 manage_command(this, "list-conns", list_conns, reg);
1688 manage_command(this, "list-certs", list_certs, reg);
1689 manage_command(this, "get-algorithms", get_algorithms, reg);
1690 manage_command(this, "get-counters", get_counters, reg);
1691 manage_command(this, "reset-counters", reset_counters, reg);
1692 manage_command(this, "version", version, reg);
1693 manage_command(this, "stats", stats, reg);
1694 }
1695
1696 METHOD(listener_t, ike_updown, bool,
1697 private_vici_query_t *this, ike_sa_t *ike_sa, bool up)
1698 {
1699 vici_builder_t *b;
1700 time_t now;
1701
1702 if (!this->dispatcher->has_event_listeners(this->dispatcher, "ike-updown"))
1703 {
1704 return TRUE;
1705 }
1706
1707 now = time_monotonic(NULL);
1708
1709 b = vici_builder_create();
1710
1711 if (up)
1712 {
1713 b->add_kv(b, "up", "yes");
1714 }
1715
1716 b->begin_section(b, ike_sa->get_name(ike_sa));
1717 list_ike(this, b, ike_sa, now);
1718 b->end_section(b);
1719
1720 this->dispatcher->raise_event(this->dispatcher,
1721 "ike-updown", 0, b->finalize(b));
1722
1723 return TRUE;
1724 }
1725
1726 METHOD(listener_t, ike_rekey, bool,
1727 private_vici_query_t *this, ike_sa_t *old, ike_sa_t *new)
1728 {
1729 vici_builder_t *b;
1730 time_t now;
1731
1732 if (!this->dispatcher->has_event_listeners(this->dispatcher, "ike-rekey"))
1733 {
1734 return TRUE;
1735 }
1736
1737 now = time_monotonic(NULL);
1738
1739 b = vici_builder_create();
1740 b->begin_section(b, old->get_name(old));
1741 b->begin_section(b, "old");
1742 list_ike(this, b, old, now);
1743 b->end_section(b);
1744 b->begin_section(b, "new");
1745 list_ike(this, b, new, now);
1746 b->end_section(b);
1747 b->end_section(b);
1748
1749 this->dispatcher->raise_event(this->dispatcher,
1750 "ike-rekey", 0, b->finalize(b));
1751
1752 return TRUE;
1753 }
1754
1755 METHOD(listener_t, child_updown, bool,
1756 private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up)
1757 {
1758 vici_builder_t *b;
1759 time_t now;
1760 char buf[BUF_LEN];
1761
1762 if (!this->dispatcher->has_event_listeners(this->dispatcher, "child-updown"))
1763 {
1764 return TRUE;
1765 }
1766
1767 now = time_monotonic(NULL);
1768 b = vici_builder_create();
1769
1770 if (up)
1771 {
1772 b->add_kv(b, "up", "yes");
1773 }
1774
1775 b->begin_section(b, ike_sa->get_name(ike_sa));
1776 list_ike(this, b, ike_sa, now);
1777 b->begin_section(b, "child-sas");
1778
1779 snprintf(buf, sizeof(buf), "%s-%u", child_sa->get_name(child_sa),
1780 child_sa->get_unique_id(child_sa));
1781
1782 b->begin_section(b, buf);
1783 list_child(this, b, child_sa, now);
1784 b->end_section(b);
1785
1786 b->end_section(b);
1787 b->end_section(b);
1788
1789 this->dispatcher->raise_event(this->dispatcher,
1790 "child-updown", 0, b->finalize(b));
1791
1792 return TRUE;
1793 }
1794
1795 METHOD(listener_t, child_rekey, bool,
1796 private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *old,
1797 child_sa_t *new)
1798 {
1799 vici_builder_t *b;
1800 time_t now;
1801
1802 if (!this->dispatcher->has_event_listeners(this->dispatcher, "child-rekey"))
1803 {
1804 return TRUE;
1805 }
1806
1807 now = time_monotonic(NULL);
1808 b = vici_builder_create();
1809
1810 b->begin_section(b, ike_sa->get_name(ike_sa));
1811 list_ike(this, b, ike_sa, now);
1812 b->begin_section(b, "child-sas");
1813
1814 b->begin_section(b, old->get_name(old));
1815
1816 b->begin_section(b, "old");
1817 list_child(this, b, old, now);
1818 b->end_section(b);
1819 b->begin_section(b, "new");
1820 list_child(this, b, new, now);
1821 b->end_section(b);
1822
1823 b->end_section(b);
1824
1825 b->end_section(b);
1826 b->end_section(b);
1827
1828 this->dispatcher->raise_event(this->dispatcher,
1829 "child-rekey", 0, b->finalize(b));
1830
1831 return TRUE;
1832 }
1833
1834 METHOD(vici_query_t, destroy, void,
1835 private_vici_query_t *this)
1836 {
1837 manage_commands(this, FALSE);
1838 free(this);
1839 }
1840
1841 /**
1842 * See header
1843 */
1844 vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
1845 {
1846 private_vici_query_t *this;
1847
1848 INIT(this,
1849 .public = {
1850 .listener = {
1851 .ike_updown = _ike_updown,
1852 .ike_rekey = _ike_rekey,
1853 .child_updown = _child_updown,
1854 .child_rekey = _child_rekey,
1855 },
1856 .destroy = _destroy,
1857 },
1858 .dispatcher = dispatcher,
1859 .uptime = time_monotonic(NULL),
1860 );
1861
1862 manage_commands(this, TRUE);
1863
1864 return &this->public;
1865 }
strongSwan - IPsec VPN