src/starter/starterwhack.c

   1 /* strongSwan whack functions to communicate with pluto (whack.c)
   2  * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
   3  *
   4  * This program is free software; you can redistribute it and/or modify it
   5  * under the terms of the GNU General Public License as published by the
   6  * Free Software Foundation; either version 2 of the License, or (at your
   7  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   8  *
   9  * This program is distributed in the hope that it will be useful, but
  10  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  11  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * for more details.
  13  *
  14  * RCSID $Id$
  15  */
  16
  17 #include <sys/types.h>
  18 #include <sys/socket.h>
  19 #include <sys/un.h>
  20 #include <stddef.h>
  21 #include <unistd.h>
  22 #include <errno.h>
  23
  24 #include <freeswan.h>
  25
  26 #include <constants.h>
  27 #include <defs.h>
  28 #include <log.h>
  29 #include <whack.h>
  30
  31 #include "starterwhack.h"
  32 #include "confread.h"
  33 #include "files.h"
  34
  35 static int
  36 pack_str (char **p, char **next, char **roof)
  37 {
  38     const char *s = (*p==NULL) ? "" : *p;    /* note: NULL becomes ""! */
  39     size_t len = strlen(s) + 1;
  40
  41     if ((*roof - *next) < len)
  42     {
  43         return 0;       /* not enough space */
  44     }
  45     else
  46     {
  47         strcpy(*next, s);
  48         *next += len;
  49         *p = NULL;   /* don't send pointers on the wire! */
  50         return 1;
  51     }
  52 }
  53
  54 static int
  55 send_whack_msg (whack_message_t *msg)
  56 {
  57     struct sockaddr_un ctl_addr = { AF_UNIX, PLUTO_CTL_FILE };
  58     int sock;
  59     ssize_t len;
  60     char *str_next, *str_roof;
  61
  62     /* pack strings */
  63     str_next = (char *)msg->string;
  64     str_roof = (char *)&msg->string[sizeof(msg->string)];
  65
  66     if (!pack_str(&msg->name,         &str_next, &str_roof)
  67     ||  !pack_str(&msg->left.id,      &str_next, &str_roof)
  68     ||  !pack_str(&msg->left.cert,    &str_next, &str_roof)
  69     ||  !pack_str(&msg->left.ca,      &str_next, &str_roof)
  70     ||  !pack_str(&msg->left.groups,  &str_next, &str_roof)
  71     ||  !pack_str(&msg->left.updown,  &str_next, &str_roof)
  72     ||  !pack_str(&msg->left.virt,    &str_next, &str_roof)
  73     ||  !pack_str(&msg->right.id,     &str_next, &str_roof)
  74     ||  !pack_str(&msg->right.cert,   &str_next, &str_roof)
  75     ||  !pack_str(&msg->right.ca,     &str_next, &str_roof)
  76     ||  !pack_str(&msg->right.groups, &str_next, &str_roof)
  77     ||  !pack_str(&msg->right.updown, &str_next, &str_roof)
  78     || !pack_str(&msg->right.virt,    &str_next, &str_roof)
  79     || !pack_str(&msg->keyid,         &str_next, &str_roof)
  80     || !pack_str(&msg->myid,          &str_next, &str_roof)
  81     || !pack_str(&msg->cacert,        &str_next, &str_roof)
  82     || !pack_str(&msg->ldaphost,      &str_next, &str_roof)
  83     || !pack_str(&msg->ldapbase,      &str_next, &str_roof)
  84     || !pack_str(&msg->crluri,        &str_next, &str_roof)
  85     || !pack_str(&msg->crluri2,       &str_next, &str_roof)
  86     || !pack_str(&msg->ocspuri,       &str_next, &str_roof)
  87     || !pack_str(&msg->ike,           &str_next, &str_roof)
  88     || !pack_str(&msg->esp,           &str_next, &str_roof)
  89     || !pack_str(&msg->sc_data,       &str_next, &str_roof)
  90     || (str_roof - str_next < msg->keyval.len))
  91     {
  92         plog("send_wack_msg(): can't pack strings");
  93         return -1;
  94     }
  95     if (msg->keyval.ptr)
  96         memcpy(str_next, msg->keyval.ptr, msg->keyval.len);
  97     msg->keyval.ptr = NULL;
  98     str_next += msg->keyval.len;
  99     len = str_next - (char *)msg;
 100
 101     /* connect to pluto ctl */
 102     sock = socket(AF_UNIX, SOCK_STREAM, 0);
 103     if (sock < 0)
 104     {
 105         plog("socket() failed: %s", strerror(errno));
 106         return -1;
 107     }
 108     if (connect(sock, (struct sockaddr *)&ctl_addr,
 109         offsetof(struct sockaddr_un, sun_path) + strlen(ctl_addr.sun_path)) < 0)
 110     {
 111         plog("connect(pluto_ctl) failed: %s", strerror(errno));
 112         close(sock);
 113         return -1;
 114     }
 115
 116     /* send message */
 117     if (write(sock, msg, len) != len)
 118     {
 119         plog("write(pluto_ctl) failed: %s", strerror(errno));
 120         close(sock);
 121         return -1;
 122     }
 123
 124     /* TODO: read reply */
 125     close(sock);
 126     return 0;
 127 }
 128
 129 static void
 130 init_whack_msg(whack_message_t *msg)
 131 {
 132     memset(msg, 0, sizeof(whack_message_t));
 133     msg->magic = WHACK_MAGIC;
 134 }
 135
 136 static char *
 137 connection_name(starter_conn_t *conn)
 138 {
 139     /* if connection name is '%auto', create a new name like conn_xxxxx */
 140     static char buf[32];
 141
 142     if (streq(conn->name, "%auto"))
 143     {
 144         sprintf(buf, "conn_%ld", conn->id);
 145         return buf;
 146     }
 147     return conn->name;
 148 }
 149
 150 static void
 151 set_whack_end(whack_end_t *w, starter_end_t *end, sa_family_t family)
 152 {
 153     w->id                  = end->id;
 154     w->cert                = end->cert;
 155     w->ca                  = end->ca;
 156     w->groups              = end->groups;
 157     w->host_addr           = end->addr;
 158     w->host_srcip          = end->srcip;
 159     w->has_client          = end->has_client;
 160
 161     if (family == AF_INET6 && isanyaddr(&end->nexthop))
 162     {
 163         anyaddr(AF_INET6, &end->nexthop);
 164     }
 165     w->host_nexthop        = end->nexthop;
 166
 167     if (w->has_client)
 168         w->client          = end->subnet;
 169     else
 170         w->client.addr.u.v4.sin_family = addrtypeof(&w->host_addr);
 171
 172     w->has_client_wildcard = end->has_client_wildcard;
 173     w->has_port_wildcard   = end->has_port_wildcard;
 174     w->has_srcip           = end->has_srcip;
 175     w->has_natip           = end->has_natip;
 176     w->allow_any           = end->allow_any && !end->dns_failed;
 177     w->modecfg             = end->modecfg;
 178     w->hostaccess          = end->hostaccess;
 179     w->sendcert            = end->sendcert;
 180     w->updown              = end->updown;
 181     w->host_port           = IKE_UDP_PORT;
 182     w->port                = end->port;
 183     w->protocol            = end->protocol;
 184     w->virt                = end->virt;
 185
 186     if (w->port != 0)
 187     {
 188         int port = htons(w->port);
 189
 190         setportof(port, &w->host_addr);
 191         setportof(port, &w->client.addr);
 192     }
 193 }
 194
 195 static int
 196 starter_whack_add_pubkey (starter_conn_t *conn, starter_end_t *end
 197 , const char *lr)
 198 {
 199     const char *err;
 200     static char keyspace[1024 + 4];
 201     whack_message_t msg;
 202
 203     init_whack_msg(&msg);
 204
 205     msg.whack_key = TRUE;
 206     msg.pubkey_alg = PUBKEY_ALG_RSA;
 207     if (end->id && end->rsakey)
 208     {
 209         /* special values to ignore */
 210         if (streq(end->rsakey, "")
 211         ||  streq(end->rsakey, "%none")
 212         ||  streq(end->rsakey, "%cert")
 213         ||  streq(end->rsakey, "0x00"))
 214         {
 215             return 0;
 216         }
 217         msg.keyid = end->id;
 218         err = atobytes(end->rsakey, 0, keyspace, sizeof(keyspace), &msg.keyval.len);
 219         if (err)
 220         {
 221             plog("conn %s/%s: rsakey malformed [%s]", connection_name(conn), lr, err);
 222             return 1;
 223         }
 224         else
 225         {
 226             msg.keyval.ptr = keyspace;
 227             return send_whack_msg(&msg);
 228         }
 229     }
 230     return 0;
 231 }
 232
 233 int
 234 starter_whack_add_conn(starter_conn_t *conn)
 235 {
 236     whack_message_t msg;
 237     int r;
 238
 239     init_whack_msg(&msg);
 240
 241     msg.whack_connection = TRUE;
 242     msg.name = connection_name(conn);
 243
 244     msg.ikev1                 = conn->keyexchange != KEY_EXCHANGE_IKEV2;
 245     msg.addr_family           = conn->addr_family;
 246     msg.tunnel_addr_family    = conn->tunnel_addr_family;
 247     msg.sa_ike_life_seconds   = conn->sa_ike_life_seconds;
 248     msg.sa_ipsec_life_seconds = conn->sa_ipsec_life_seconds;
 249     msg.sa_rekey_margin       = conn->sa_rekey_margin;
 250     msg.sa_rekey_fuzz         = conn->sa_rekey_fuzz;
 251     msg.sa_keying_tries       = conn->sa_keying_tries;
 252     msg.policy                = conn->policy;
 253
 254     /*
 255      * Make sure the IKEv2-only policy bits are unset for IKEv1 connections
 256      */
 257     msg.policy &= ~POLICY_DONT_REAUTH;
 258     msg.policy &= ~POLICY_BEET;
 259     msg.policy &= ~POLICY_MOBIKE;
 260     msg.policy &= ~POLICY_FORCE_ENCAP;
 261
 262     set_whack_end(&msg.left, &conn->left, conn->addr_family);
 263     set_whack_end(&msg.right, &conn->right, conn->addr_family);
 264
 265     msg.esp = conn->esp;
 266     msg.ike = conn->ike;
 267     msg.pfsgroup = conn->pfsgroup;
 268
 269     /* taken from pluto/whack.c */
 270     if (msg.pfsgroup)
 271     {
 272         char esp_buf[256];
 273
 274         snprintf(esp_buf, sizeof (esp_buf), "%s;%s"
 275                    , msg.esp ? msg.esp : ""
 276                    , msg.pfsgroup ? msg.pfsgroup : "");
 277         msg.esp = esp_buf;
 278
 279         DBG(DBG_CONTROL,
 280             DBG_log("Setting --esp=%s", msg.esp)
 281         )
 282     }
 283     msg.dpd_delay   = conn->dpd_delay;
 284     msg.dpd_timeout = conn->dpd_timeout;
 285     msg.dpd_action  = conn->dpd_action;
 286 /*  msg.dpd_count = conn->dpd_count; not supported yet by strongSwan */
 287
 288     r =  send_whack_msg(&msg);
 289
 290     if (r == 0 && (conn->policy & POLICY_RSASIG))
 291     {
 292         r += starter_whack_add_pubkey (conn, &conn->left, "left");
 293         r += starter_whack_add_pubkey (conn, &conn->right, "right");
 294     }
 295
 296     return r;
 297 }
 298
 299 int
 300 starter_whack_del_conn(starter_conn_t *conn)
 301 {
 302     whack_message_t msg;
 303
 304     init_whack_msg(&msg);
 305     msg.whack_delete = TRUE;
 306     msg.name = connection_name(conn);
 307     return send_whack_msg(&msg);
 308 }
 309
 310 int
 311 starter_whack_route_conn(starter_conn_t *conn)
 312 {
 313     whack_message_t msg;
 314
 315     init_whack_msg(&msg);
 316     msg.whack_route = TRUE;
 317     msg.name = connection_name(conn);
 318     return send_whack_msg(&msg);
 319 }
 320
 321 int
 322 starter_whack_initiate_conn(starter_conn_t *conn)
 323 {
 324     whack_message_t msg;
 325
 326     init_whack_msg(&msg);
 327     msg.whack_initiate = TRUE;
 328     msg.whack_async = TRUE;
 329     msg.name = connection_name(conn);
 330     return send_whack_msg(&msg);
 331 }
 332
 333 int
 334 starter_whack_listen(void)
 335 {
 336     whack_message_t msg;
 337     init_whack_msg(&msg);
 338     msg.whack_listen = TRUE;
 339     return send_whack_msg(&msg);
 340 }
 341
 342 int starter_whack_shutdown(void)
 343 {
 344     whack_message_t msg;
 345
 346     init_whack_msg(&msg);
 347     msg.whack_shutdown = TRUE;
 348     return send_whack_msg(&msg);
 349 }
 350
 351 int
 352 starter_whack_add_ca(starter_ca_t *ca)
 353 {
 354     whack_message_t msg;
 355
 356     init_whack_msg(&msg);
 357
 358     msg.whack_ca     = TRUE;
 359     msg.name         = ca->name;
 360     msg.cacert       = ca->cacert;
 361     msg.ldaphost     = ca->ldaphost;
 362     msg.ldapbase     = ca->ldapbase;
 363     msg.crluri       = ca->crluri;
 364     msg.crluri2      = ca->crluri2;
 365     msg.ocspuri      = ca->ocspuri;
 366     msg.whack_strict = ca->strict;
 367
 368     return send_whack_msg(&msg);
 369 }
 370
 371 int
 372 starter_whack_del_ca(starter_ca_t *ca)
 373 {
 374     whack_message_t msg;
 375
 376     init_whack_msg(&msg);
 377
 378     msg.whack_delete = TRUE;
 379     msg.whack_ca     = TRUE;
 380     msg.name         = ca->name;
 381
 382     return send_whack_msg(&msg);
 383 }