1 /* strongSwan whack functions to communicate with pluto (whack.c)
2 * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
4 * This program is free software; you can redistribute it and/or modify it
5 * under the terms of the GNU General Public License as published by the
6 * Free Software Foundation; either version 2 of the License, or (at your
7 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 * This program is distributed in the hope that it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 #include <sys/types.h>
18 #include <sys/socket.h>
26 #include <constants.h>
31 #include "starterwhack.h"
36 pack_str (char **p
, char **next
, char **roof
)
38 const char *s
= (*p
==NULL
) ?
"" : *p
; /* note: NULL becomes ""! */
39 size_t len
= strlen(s
) + 1;
41 if ((*roof
- *next
) < len
)
43 return 0; /* not enough space */
49 *p
= NULL
; /* don't send pointers on the wire! */
55 send_whack_msg (whack_message_t
*msg
)
57 struct sockaddr_un ctl_addr
= { AF_UNIX
, PLUTO_CTL_FILE
};
60 char *str_next
, *str_roof
;
63 str_next
= (char *)msg
->string
;
64 str_roof
= (char *)&msg
->string
[sizeof(msg
->string
)];
66 if (!pack_str(&msg
->name
, &str_next
, &str_roof
)
67 || !pack_str(&msg
->left
.id
, &str_next
, &str_roof
)
68 || !pack_str(&msg
->left
.cert
, &str_next
, &str_roof
)
69 || !pack_str(&msg
->left
.ca
, &str_next
, &str_roof
)
70 || !pack_str(&msg
->left
.groups
, &str_next
, &str_roof
)
71 || !pack_str(&msg
->left
.updown
, &str_next
, &str_roof
)
72 || !pack_str(&msg
->left
.virt
, &str_next
, &str_roof
)
73 || !pack_str(&msg
->right
.id
, &str_next
, &str_roof
)
74 || !pack_str(&msg
->right
.cert
, &str_next
, &str_roof
)
75 || !pack_str(&msg
->right
.ca
, &str_next
, &str_roof
)
76 || !pack_str(&msg
->right
.groups
, &str_next
, &str_roof
)
77 || !pack_str(&msg
->right
.updown
, &str_next
, &str_roof
)
78 || !pack_str(&msg
->right
.virt
, &str_next
, &str_roof
)
79 || !pack_str(&msg
->keyid
, &str_next
, &str_roof
)
80 || !pack_str(&msg
->myid
, &str_next
, &str_roof
)
81 || !pack_str(&msg
->cacert
, &str_next
, &str_roof
)
82 || !pack_str(&msg
->ldaphost
, &str_next
, &str_roof
)
83 || !pack_str(&msg
->ldapbase
, &str_next
, &str_roof
)
84 || !pack_str(&msg
->crluri
, &str_next
, &str_roof
)
85 || !pack_str(&msg
->crluri2
, &str_next
, &str_roof
)
86 || !pack_str(&msg
->ocspuri
, &str_next
, &str_roof
)
87 || !pack_str(&msg
->ike
, &str_next
, &str_roof
)
88 || !pack_str(&msg
->esp
, &str_next
, &str_roof
)
89 || !pack_str(&msg
->sc_data
, &str_next
, &str_roof
)
90 || (str_roof
- str_next
< msg
->keyval
.len
))
92 plog("send_wack_msg(): can't pack strings");
96 memcpy(str_next
, msg
->keyval
.ptr
, msg
->keyval
.len
);
97 msg
->keyval
.ptr
= NULL
;
98 str_next
+= msg
->keyval
.len
;
99 len
= str_next
- (char *)msg
;
101 /* connect to pluto ctl */
102 sock
= socket(AF_UNIX
, SOCK_STREAM
, 0);
105 plog("socket() failed: %s", strerror(errno
));
108 if (connect(sock
, (struct sockaddr
*)&ctl_addr
,
109 offsetof(struct sockaddr_un
, sun_path
) + strlen(ctl_addr
.sun_path
)) < 0)
111 plog("connect(pluto_ctl) failed: %s", strerror(errno
));
117 if (write(sock
, msg
, len
) != len
)
119 plog("write(pluto_ctl) failed: %s", strerror(errno
));
124 /* TODO: read reply */
130 init_whack_msg(whack_message_t
*msg
)
132 memset(msg
, 0, sizeof(whack_message_t
));
133 msg
->magic
= WHACK_MAGIC
;
137 connection_name(starter_conn_t
*conn
)
139 /* if connection name is '%auto', create a new name like conn_xxxxx */
142 if (streq(conn
->name
, "%auto"))
144 sprintf(buf
, "conn_%ld", conn
->id
);
151 set_whack_end(whack_end_t
*w
, starter_end_t
*end
, sa_family_t family
)
156 w
->groups
= end
->groups
;
157 w
->host_addr
= end
->addr
;
158 w
->host_srcip
= end
->srcip
;
159 w
->has_client
= end
->has_client
;
161 if (family
== AF_INET6
&& isanyaddr(&end
->nexthop
))
163 anyaddr(AF_INET6
, &end
->nexthop
);
165 w
->host_nexthop
= end
->nexthop
;
168 w
->client
= end
->subnet
;
170 w
->client
.addr
.u
.v4
.sin_family
= addrtypeof(&w
->host_addr
);
172 w
->has_client_wildcard
= end
->has_client_wildcard
;
173 w
->has_port_wildcard
= end
->has_port_wildcard
;
174 w
->has_srcip
= end
->has_srcip
;
175 w
->has_natip
= end
->has_natip
;
176 w
->allow_any
= end
->allow_any
&& !end
->dns_failed
;
177 w
->modecfg
= end
->modecfg
;
178 w
->hostaccess
= end
->hostaccess
;
179 w
->sendcert
= end
->sendcert
;
180 w
->updown
= end
->updown
;
181 w
->host_port
= IKE_UDP_PORT
;
183 w
->protocol
= end
->protocol
;
188 int port
= htons(w
->port
);
190 setportof(port
, &w
->host_addr
);
191 setportof(port
, &w
->client
.addr
);
196 starter_whack_add_pubkey (starter_conn_t
*conn
, starter_end_t
*end
200 static char keyspace
[1024 + 4];
203 init_whack_msg(&msg
);
205 msg
.whack_key
= TRUE
;
206 msg
.pubkey_alg
= PUBKEY_ALG_RSA
;
207 if (end
->id
&& end
->rsakey
)
209 /* special values to ignore */
210 if (streq(end
->rsakey
, "")
211 || streq(end
->rsakey
, "%none")
212 || streq(end
->rsakey
, "%cert")
213 || streq(end
->rsakey
, "0x00"))
218 err
= atobytes(end
->rsakey
, 0, keyspace
, sizeof(keyspace
), &msg
.keyval
.len
);
221 plog("conn %s/%s: rsakey malformed [%s]", connection_name(conn
), lr
, err
);
226 msg
.keyval
.ptr
= keyspace
;
227 return send_whack_msg(&msg
);
234 starter_whack_add_conn(starter_conn_t
*conn
)
239 init_whack_msg(&msg
);
241 msg
.whack_connection
= TRUE
;
242 msg
.name
= connection_name(conn
);
244 msg
.ikev1
= conn
->keyexchange
!= KEY_EXCHANGE_IKEV2
;
245 msg
.addr_family
= conn
->addr_family
;
246 msg
.tunnel_addr_family
= conn
->tunnel_addr_family
;
247 msg
.sa_ike_life_seconds
= conn
->sa_ike_life_seconds
;
248 msg
.sa_ipsec_life_seconds
= conn
->sa_ipsec_life_seconds
;
249 msg
.sa_rekey_margin
= conn
->sa_rekey_margin
;
250 msg
.sa_rekey_fuzz
= conn
->sa_rekey_fuzz
;
251 msg
.sa_keying_tries
= conn
->sa_keying_tries
;
252 msg
.policy
= conn
->policy
;
255 * Make sure the IKEv2-only policy bits are unset for IKEv1 connections
257 msg
.policy
&= ~POLICY_DONT_REAUTH
;
258 msg
.policy
&= ~POLICY_BEET
;
259 msg
.policy
&= ~POLICY_MOBIKE
;
260 msg
.policy
&= ~POLICY_FORCE_ENCAP
;
262 set_whack_end(&msg
.left
, &conn
->left
, conn
->addr_family
);
263 set_whack_end(&msg
.right
, &conn
->right
, conn
->addr_family
);
267 msg
.pfsgroup
= conn
->pfsgroup
;
269 /* taken from pluto/whack.c */
274 snprintf(esp_buf
, sizeof (esp_buf
), "%s;%s"
275 , msg
.esp ? msg
.esp
: ""
276 , msg
.pfsgroup ? msg
.pfsgroup
: "");
280 DBG_log("Setting --esp=%s", msg
.esp
)
283 msg
.dpd_delay
= conn
->dpd_delay
;
284 msg
.dpd_timeout
= conn
->dpd_timeout
;
285 msg
.dpd_action
= conn
->dpd_action
;
286 /* msg.dpd_count = conn->dpd_count; not supported yet by strongSwan */
288 r
= send_whack_msg(&msg
);
290 if (r
== 0 && (conn
->policy
& POLICY_RSASIG
))
292 r
+= starter_whack_add_pubkey (conn
, &conn
->left
, "left");
293 r
+= starter_whack_add_pubkey (conn
, &conn
->right
, "right");
300 starter_whack_del_conn(starter_conn_t
*conn
)
304 init_whack_msg(&msg
);
305 msg
.whack_delete
= TRUE
;
306 msg
.name
= connection_name(conn
);
307 return send_whack_msg(&msg
);
311 starter_whack_route_conn(starter_conn_t
*conn
)
315 init_whack_msg(&msg
);
316 msg
.whack_route
= TRUE
;
317 msg
.name
= connection_name(conn
);
318 return send_whack_msg(&msg
);
322 starter_whack_initiate_conn(starter_conn_t
*conn
)
326 init_whack_msg(&msg
);
327 msg
.whack_initiate
= TRUE
;
328 msg
.whack_async
= TRUE
;
329 msg
.name
= connection_name(conn
);
330 return send_whack_msg(&msg
);
334 starter_whack_listen(void)
337 init_whack_msg(&msg
);
338 msg
.whack_listen
= TRUE
;
339 return send_whack_msg(&msg
);
342 int starter_whack_shutdown(void)
346 init_whack_msg(&msg
);
347 msg
.whack_shutdown
= TRUE
;
348 return send_whack_msg(&msg
);
352 starter_whack_add_ca(starter_ca_t
*ca
)
356 init_whack_msg(&msg
);
360 msg
.cacert
= ca
->cacert
;
361 msg
.ldaphost
= ca
->ldaphost
;
362 msg
.ldapbase
= ca
->ldapbase
;
363 msg
.crluri
= ca
->crluri
;
364 msg
.crluri2
= ca
->crluri2
;
365 msg
.ocspuri
= ca
->ocspuri
;
366 msg
.whack_strict
= ca
->strict
;
368 return send_whack_msg(&msg
);
372 starter_whack_del_ca(starter_ca_t
*ca
)
376 init_whack_msg(&msg
);
378 msg
.whack_delete
= TRUE
;
382 return send_whack_msg(&msg
);