src/swanctl/commands/load_creds.c

   1 /*
   2  * Copyright (C) 2014 Martin Willi
   3  * Copyright (C) 2014 revosec AG
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #define _GNU_SOURCE
  17 #include <stdio.h>
  18 #include <errno.h>
  19 #include <unistd.h>
  20 #include <sys/stat.h>
  21
  22 #include "command.h"
  23 #include "swanctl.h"
  24
  25 #include <credentials/sets/callback_cred.h>
  26
  27 /**
  28  * Load a single certificate over vici
  29  */
  30 static bool load_cert(vici_conn_t *conn, bool raw, char *dir,
  31                                           char *type, chunk_t data)
  32 {
  33         vici_req_t *req;
  34         vici_res_t *res;
  35         bool ret = TRUE;
  36
  37         req = vici_begin("load-cert");
  38
  39         vici_add_key_valuef(req, "type", "%s", type);
  40         vici_add_key_value(req, "data", data.ptr, data.len);
  41
  42         res = vici_submit(req, conn);
  43         if (!res)
  44         {
  45                 fprintf(stderr, "load-cert request failed: %s\n", strerror(errno));
  46                 return FALSE;
  47         }
  48         if (raw)
  49         {
  50                 vici_dump(res, "load-cert reply", stdout);
  51         }
  52         else if (!streq(vici_find_str(res, "no", "success"), "yes"))
  53         {
  54                 fprintf(stderr, "loading '%s' failed: %s\n",
  55                                 dir, vici_find_str(res, "", "errmsg"));
  56                 ret = FALSE;
  57         }
  58         else
  59         {
  60                 printf("loaded %s certificate '%s'\n", type, dir);
  61         }
  62         vici_free_res(res);
  63         return ret;
  64 }
  65
  66 /**
  67  * Load certficiates from a directory
  68  */
  69 static void load_certs(vici_conn_t *conn, bool raw, char *type, char *dir)
  70 {
  71         enumerator_t *enumerator;
  72         struct stat st;
  73         chunk_t *map;
  74         char *path;
  75
  76         enumerator = enumerator_create_directory(dir);
  77         if (enumerator)
  78         {
  79                 while (enumerator->enumerate(enumerator, NULL, &path, &st))
  80                 {
  81                         if (S_ISREG(st.st_mode))
  82                         {
  83                                 map = chunk_map(path, FALSE);
  84                                 if (map)
  85                                 {
  86                                         load_cert(conn, raw, path, type, *map);
  87                                         chunk_unmap(map);
  88                                 }
  89                                 else
  90                                 {
  91                                         fprintf(stderr, "mapping '%s' failed: %s, skipped\n",
  92                                                         path, strerror(errno));
  93                                 }
  94                         }
  95                 }
  96                 enumerator->destroy(enumerator);
  97         }
  98 }
  99
 100 /**
 101  * Load a single private key over vici
 102  */
 103 static bool load_key(vici_conn_t *conn, bool raw, char *dir,
 104                                           char *type, chunk_t data)
 105 {
 106         vici_req_t *req;
 107         vici_res_t *res;
 108         bool ret = TRUE;
 109
 110         req = vici_begin("load-key");
 111
 112         vici_add_key_valuef(req, "type", "%s", type);
 113         vici_add_key_value(req, "data", data.ptr, data.len);
 114
 115         res = vici_submit(req, conn);
 116         if (!res)
 117         {
 118                 fprintf(stderr, "load-key request failed: %s\n", strerror(errno));
 119                 return FALSE;
 120         }
 121         if (raw)
 122         {
 123                 vici_dump(res, "load-key reply", stdout);
 124         }
 125         else if (!streq(vici_find_str(res, "no", "success"), "yes"))
 126         {
 127                 fprintf(stderr, "loading '%s' failed: %s\n",
 128                                 dir, vici_find_str(res, "", "errmsg"));
 129                 ret = FALSE;
 130         }
 131         else
 132         {
 133                 printf("loaded %s key '%s'\n", type, dir);
 134         }
 135         vici_free_res(res);
 136         return ret;
 137 }
 138
 139 /**
 140  * Callback function to prompt for private key passwords
 141  */
 142 CALLBACK(password_cb, shared_key_t*,
 143         char *prompt, shared_key_type_t type,
 144         identification_t *me, identification_t *other,
 145         id_match_t *match_me, id_match_t *match_other)
 146 {
 147         char *pwd;
 148
 149         if (type != SHARED_PRIVATE_KEY_PASS)
 150         {
 151                 return NULL;
 152         }
 153         pwd = getpass(prompt);
 154         if (!pwd || strlen(pwd) == 0)
 155         {
 156                 return NULL;
 157         }
 158         if (match_me)
 159         {
 160                 *match_me = ID_MATCH_PERFECT;
 161         }
 162         if (match_other)
 163         {
 164                 *match_other = ID_MATCH_PERFECT;
 165         }
 166         return shared_key_create(type, chunk_clone(chunk_from_str(pwd)));
 167 }
 168
 169 /**
 170  * Try to parse a potentially encrypted private key
 171  */
 172 static private_key_t* decrypt_key(char *name, char *type, chunk_t encoding)
 173 {
 174         key_type_t kt = KEY_ANY;
 175         private_key_t *private;
 176         callback_cred_t *cb;
 177         char buf[128];
 178
 179         if (streq(type, "rsa"))
 180         {
 181                 kt = KEY_RSA;
 182         }
 183         else if (streq(type, "ecdsa"))
 184         {
 185                 kt = KEY_ECDSA;
 186         }
 187
 188         snprintf(buf, sizeof(buf), "Password for '%s': ", name);
 189
 190         cb = callback_cred_create_shared(password_cb, buf);
 191         lib->credmgr->add_set(lib->credmgr, &cb->set);
 192
 193         private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, kt,
 194                                                                  BUILD_BLOB_PEM, encoding, BUILD_END);
 195
 196         lib->credmgr->remove_set(lib->credmgr, &cb->set);
 197         cb->destroy(cb);
 198
 199         return private;
 200 }
 201
 202 /**
 203  * Try to decrypt and load a private key
 204  */
 205 static bool load_encrypted_key(vici_conn_t *conn, bool raw,
 206                                                            char *rel, char *path, char *type, chunk_t data)
 207 {
 208         private_key_t *private;
 209         bool loaded = FALSE;
 210         chunk_t encoding;
 211
 212         private = decrypt_key(rel, type, data);
 213         if (private)
 214         {
 215                 if (private->get_encoding(private, PRIVKEY_ASN1_DER,
 216                                                                   &encoding))
 217                 {
 218                         switch (private->get_type(private))
 219                         {
 220                                 case KEY_RSA:
 221                                         loaded = load_key(conn, raw, path, "rsa", encoding);
 222                                         break;
 223                                 case KEY_ECDSA:
 224                                         loaded = load_key(conn, raw, path, "ecdsa", encoding);
 225                                         break;
 226                                 default:
 227                                         break;
 228                         }
 229                         chunk_clear(&encoding);
 230                 }
 231                 private->destroy(private);
 232         }
 233         return loaded;
 234 }
 235
 236 /**
 237  * Load private keys from a directory
 238  */
 239 static void load_keys(vici_conn_t *conn, bool raw, bool noprompt,
 240                                           char *type, char *dir)
 241 {
 242         enumerator_t *enumerator;
 243         struct stat st;
 244         chunk_t *map;
 245         char *path, *rel;
 246
 247         enumerator = enumerator_create_directory(dir);
 248         if (enumerator)
 249         {
 250                 while (enumerator->enumerate(enumerator, &rel, &path, &st))
 251                 {
 252                         if (S_ISREG(st.st_mode))
 253                         {
 254                                 map = chunk_map(path, FALSE);
 255                                 if (map)
 256                                 {
 257                                         if (noprompt ||
 258                                                 !load_encrypted_key(conn, raw, rel, path, type, *map))
 259                                         {
 260                                                 load_key(conn, raw, path, type, *map);
 261                                         }
 262                                         chunk_unmap(map);
 263                                 }
 264                                 else
 265                                 {
 266                                         fprintf(stderr, "mapping '%s' failed: %s, skipped\n",
 267                                                         path, strerror(errno));
 268                                 }
 269                         }
 270                 }
 271                 enumerator->destroy(enumerator);
 272         }
 273 }
 274
 275 /**
 276  * Load a single secret for ids over VICI
 277  */
 278 static bool load_secret(vici_conn_t *conn, char *type, char *owners,
 279                                                 char *value, bool raw)
 280 {
 281         enumerator_t *enumerator;
 282         vici_req_t *req;
 283         vici_res_t *res;
 284         chunk_t data;
 285         char *owner;
 286         bool ret = TRUE;
 287
 288         req = vici_begin("load-shared");
 289
 290         vici_add_key_valuef(req, "type", "%s", type);
 291         vici_begin_list(req, "owners");
 292         enumerator = enumerator_create_token(owners, " ", " ");
 293         while (enumerator->enumerate(enumerator, &owner))
 294         {
 295                 vici_add_list_itemf(req, "%s", owner);
 296         }
 297         enumerator->destroy(enumerator);
 298         vici_end_list(req);
 299
 300         if (strcasepfx(value, "0x"))
 301         {
 302                 data = chunk_from_hex(chunk_from_str(value + 2), NULL);
 303         }
 304         else if (strcasepfx(value, "0s"))
 305         {
 306                 data = chunk_from_base64(chunk_from_str(value + 2), NULL);
 307         }
 308         else
 309         {
 310                 data = chunk_clone(chunk_from_str(value));
 311         }
 312         vici_add_key_value(req, "data", data.ptr, data.len);
 313         chunk_clear(&data);
 314
 315         res = vici_submit(req, conn);
 316         if (!res)
 317         {
 318                 fprintf(stderr, "load-shared request failed: %s\n", strerror(errno));
 319                 return FALSE;
 320         }
 321         if (raw)
 322         {
 323                 vici_dump(res, "load-shared reply", stdout);
 324         }
 325         else if (!streq(vici_find_str(res, "no", "success"), "yes"))
 326         {
 327                 fprintf(stderr, "loading shared secret failed: %s\n",
 328                                 vici_find_str(res, "", "errmsg"));
 329                 ret = FALSE;
 330         }
 331         else
 332         {
 333                 printf("loaded %s secret for: ", type);
 334                 enumerator = enumerator_create_token(owners, " ", " ");
 335                 while (enumerator->enumerate(enumerator, &owner))
 336                 {
 337                         printf("'%s' ", owner);
 338                 }
 339                 enumerator->destroy(enumerator);
 340                 printf("\n");
 341         }
 342         vici_free_res(res);
 343         return ret;
 344 }
 345
 346 /**
 347  * Load secrets from settings section
 348  */
 349 static void load_secrets(vici_conn_t *conn, settings_t *cfg,
 350                                                  char *section, bool raw)
 351 {
 352         enumerator_t *enumerator;
 353         char buf[64], *key, *value;
 354
 355         snprintf(buf, sizeof(buf), "secrets.%s", section);
 356         enumerator = cfg->create_key_value_enumerator(cfg, buf);
 357         while (enumerator->enumerate(enumerator, &key, &value))
 358         {
 359                 load_secret(conn, section, key, value, raw);
 360         }
 361         enumerator->destroy(enumerator);
 362 }
 363
 364 /**
 365  * Clear all currently loaded credentials
 366  */
 367 static bool clear_creds(vici_conn_t *conn, bool raw)
 368 {
 369         vici_res_t *res;
 370
 371         res = vici_submit(vici_begin("clear-creds"), conn);
 372         if (!res)
 373         {
 374                 fprintf(stderr, "clear-creds request failed: %s\n", strerror(errno));
 375                 return FALSE;
 376         }
 377         if (raw)
 378         {
 379                 vici_dump(res, "clear-creds reply", stdout);
 380         }
 381         vici_free_res(res);
 382         return TRUE;
 383 }
 384
 385 static int load_creds(vici_conn_t *conn)
 386 {
 387         bool raw = FALSE, clear = FALSE, noprompt = FALSE;
 388         enumerator_t *enumerator;
 389         settings_t *cfg;
 390         char *arg, *section;
 391
 392         while (TRUE)
 393         {
 394                 switch (command_getopt(&arg))
 395                 {
 396                         case 'h':
 397                                 return command_usage(NULL);
 398                         case 'c':
 399                                 clear = TRUE;
 400                                 continue;
 401                         case 'n':
 402                                 noprompt = TRUE;
 403                                 continue;
 404                         case 'r':
 405                                 raw = TRUE;
 406                                 continue;
 407                         case EOF:
 408                                 break;
 409                         default:
 410                                 return command_usage("invalid --load-creds option");
 411                 }
 412                 break;
 413         }
 414
 415         if (clear)
 416         {
 417                 if (!clear_creds(conn, raw))
 418                 {
 419                         return ECONNREFUSED;
 420                 }
 421         }
 422
 423         load_certs(conn, raw, "x509", SWANCTL_X509DIR);
 424         load_certs(conn, raw, "x509ca", SWANCTL_X509CADIR);
 425         load_certs(conn, raw, "x509aa", SWANCTL_X509AADIR);
 426         load_certs(conn, raw, "x509crl", SWANCTL_X509CRLDIR);
 427         load_certs(conn, raw, "x509ac", SWANCTL_X509ACDIR);
 428
 429         load_keys(conn, raw, noprompt, "rsa", SWANCTL_RSADIR);
 430         load_keys(conn, raw, noprompt, "ecdsa", SWANCTL_ECDSADIR);
 431         load_keys(conn, raw, noprompt, "any", SWANCTL_PKCS8DIR);
 432
 433         cfg = settings_create(SWANCTL_CONF);
 434         if (!cfg)
 435         {
 436                 fprintf(stderr, "parsing '%s' failed\n", SWANCTL_CONF);
 437                 return EINVAL;
 438         }
 439
 440         enumerator = cfg->create_section_enumerator(cfg, "secrets");
 441         while (enumerator->enumerate(enumerator, &section))
 442         {
 443                 load_secrets(conn, cfg, section, raw);
 444         }
 445         enumerator->destroy(enumerator);
 446
 447         cfg->destroy(cfg);
 448
 449         return 0;
 450 }
 451
 452 /**
 453  * Register the command.
 454  */
 455 static void __attribute__ ((constructor))reg()
 456 {
 457         command_register((command_t) {
 458                 load_creds, 's', "load-creds", "(re-)load credentials",
 459                 {"[--raw]"},
 460                 {
 461                         {"help",                'h', 0, "show usage information"},
 462                         {"clear",               'c', 0, "clear previously loaded credentials"},
 463                         {"noprompt",    'n', 0, "do not prompt for passwords"},
 464                         {"raw",                 'r', 0, "dump raw response message"},
 465                 }
 466         });
 467 }