94d31f49f009b918d5cbf881d688ddbade700a82
[strongswan.git] / src / swanctl / commands / load_creds.c
1 /*
2 * Copyright (C) 2014 Martin Willi
3 * Copyright (C) 2014 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #define _GNU_SOURCE
17 #include <stdio.h>
18 #include <errno.h>
19 #include <unistd.h>
20 #include <sys/stat.h>
21
22 #include "command.h"
23 #include "swanctl.h"
24
25 #include <credentials/sets/callback_cred.h>
26
27 /**
28 * Load a single certificate over vici
29 */
30 static bool load_cert(vici_conn_t *conn, bool raw, char *dir,
31 char *type, chunk_t data)
32 {
33 vici_req_t *req;
34 vici_res_t *res;
35 bool ret = TRUE;
36
37 req = vici_begin("load-cert");
38
39 vici_add_key_valuef(req, "type", "%s", type);
40 vici_add_key_value(req, "data", data.ptr, data.len);
41
42 res = vici_submit(req, conn);
43 if (!res)
44 {
45 fprintf(stderr, "load-cert request failed: %s\n", strerror(errno));
46 return FALSE;
47 }
48 if (raw)
49 {
50 vici_dump(res, "load-cert reply", stdout);
51 }
52 else if (!streq(vici_find_str(res, "no", "success"), "yes"))
53 {
54 fprintf(stderr, "loading '%s' failed: %s\n",
55 dir, vici_find_str(res, "", "errmsg"));
56 ret = FALSE;
57 }
58 else
59 {
60 printf("loaded %s certificate '%s'\n", type, dir);
61 }
62 vici_free_res(res);
63 return ret;
64 }
65
66 /**
67 * Load certficiates from a directory
68 */
69 static void load_certs(vici_conn_t *conn, bool raw, char *type, char *dir)
70 {
71 enumerator_t *enumerator;
72 struct stat st;
73 chunk_t *map;
74 char *path;
75
76 enumerator = enumerator_create_directory(dir);
77 if (enumerator)
78 {
79 while (enumerator->enumerate(enumerator, NULL, &path, &st))
80 {
81 if (S_ISREG(st.st_mode))
82 {
83 map = chunk_map(path, FALSE);
84 if (map)
85 {
86 load_cert(conn, raw, path, type, *map);
87 chunk_unmap(map);
88 }
89 else
90 {
91 fprintf(stderr, "mapping '%s' failed: %s, skipped\n",
92 path, strerror(errno));
93 }
94 }
95 }
96 enumerator->destroy(enumerator);
97 }
98 }
99
100 /**
101 * Load a single private key over vici
102 */
103 static bool load_key(vici_conn_t *conn, bool raw, char *dir,
104 char *type, chunk_t data)
105 {
106 vici_req_t *req;
107 vici_res_t *res;
108 bool ret = TRUE;
109
110 req = vici_begin("load-key");
111
112 vici_add_key_valuef(req, "type", "%s", type);
113 vici_add_key_value(req, "data", data.ptr, data.len);
114
115 res = vici_submit(req, conn);
116 if (!res)
117 {
118 fprintf(stderr, "load-key request failed: %s\n", strerror(errno));
119 return FALSE;
120 }
121 if (raw)
122 {
123 vici_dump(res, "load-key reply", stdout);
124 }
125 else if (!streq(vici_find_str(res, "no", "success"), "yes"))
126 {
127 fprintf(stderr, "loading '%s' failed: %s\n",
128 dir, vici_find_str(res, "", "errmsg"));
129 ret = FALSE;
130 }
131 else
132 {
133 printf("loaded %s key '%s'\n", type, dir);
134 }
135 vici_free_res(res);
136 return ret;
137 }
138
139 /**
140 * Callback function to prompt for private key passwords
141 */
142 CALLBACK(password_cb, shared_key_t*,
143 char *prompt, shared_key_type_t type,
144 identification_t *me, identification_t *other,
145 id_match_t *match_me, id_match_t *match_other)
146 {
147 char *pwd;
148
149 if (type != SHARED_PRIVATE_KEY_PASS)
150 {
151 return NULL;
152 }
153 pwd = getpass(prompt);
154 if (!pwd || strlen(pwd) == 0)
155 {
156 return NULL;
157 }
158 if (match_me)
159 {
160 *match_me = ID_MATCH_PERFECT;
161 }
162 if (match_other)
163 {
164 *match_other = ID_MATCH_PERFECT;
165 }
166 return shared_key_create(type, chunk_clone(chunk_from_str(pwd)));
167 }
168
169 /**
170 * Try to parse a potentially encrypted private key
171 */
172 static private_key_t* decrypt_key(char *name, char *type, chunk_t encoding)
173 {
174 key_type_t kt = KEY_ANY;
175 private_key_t *private;
176 callback_cred_t *cb;
177 char buf[128];
178
179 if (streq(type, "rsa"))
180 {
181 kt = KEY_RSA;
182 }
183 else if (streq(type, "ecdsa"))
184 {
185 kt = KEY_ECDSA;
186 }
187
188 snprintf(buf, sizeof(buf), "Password for '%s': ", name);
189
190 cb = callback_cred_create_shared(password_cb, buf);
191 lib->credmgr->add_set(lib->credmgr, &cb->set);
192
193 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, kt,
194 BUILD_BLOB_PEM, encoding, BUILD_END);
195
196 lib->credmgr->remove_set(lib->credmgr, &cb->set);
197 cb->destroy(cb);
198
199 return private;
200 }
201
202 /**
203 * Try to decrypt and load a private key
204 */
205 static bool load_encrypted_key(vici_conn_t *conn, bool raw,
206 char *rel, char *path, char *type, chunk_t data)
207 {
208 private_key_t *private;
209 bool loaded = FALSE;
210 chunk_t encoding;
211
212 private = decrypt_key(rel, type, data);
213 if (private)
214 {
215 if (private->get_encoding(private, PRIVKEY_ASN1_DER,
216 &encoding))
217 {
218 switch (private->get_type(private))
219 {
220 case KEY_RSA:
221 loaded = load_key(conn, raw, path, "rsa", encoding);
222 break;
223 case KEY_ECDSA:
224 loaded = load_key(conn, raw, path, "ecdsa", encoding);
225 break;
226 default:
227 break;
228 }
229 chunk_clear(&encoding);
230 }
231 private->destroy(private);
232 }
233 return loaded;
234 }
235
236 /**
237 * Load private keys from a directory
238 */
239 static void load_keys(vici_conn_t *conn, bool raw, bool noprompt,
240 char *type, char *dir)
241 {
242 enumerator_t *enumerator;
243 struct stat st;
244 chunk_t *map;
245 char *path, *rel;
246
247 enumerator = enumerator_create_directory(dir);
248 if (enumerator)
249 {
250 while (enumerator->enumerate(enumerator, &rel, &path, &st))
251 {
252 if (S_ISREG(st.st_mode))
253 {
254 map = chunk_map(path, FALSE);
255 if (map)
256 {
257 if (noprompt ||
258 !load_encrypted_key(conn, raw, rel, path, type, *map))
259 {
260 load_key(conn, raw, path, type, *map);
261 }
262 chunk_unmap(map);
263 }
264 else
265 {
266 fprintf(stderr, "mapping '%s' failed: %s, skipped\n",
267 path, strerror(errno));
268 }
269 }
270 }
271 enumerator->destroy(enumerator);
272 }
273 }
274
275 /**
276 * Load a single secret over VICI
277 */
278 static bool load_secret(vici_conn_t *conn, settings_t *cfg,
279 char *section, bool raw)
280 {
281 enumerator_t *enumerator;
282 vici_req_t *req;
283 vici_res_t *res;
284 chunk_t data;
285 char *key, *value, buf[128], *type = NULL;
286 bool ret = TRUE;
287 int i;
288 char *types[] = {
289 "eap",
290 "xauth",
291 "ike",
292 };
293
294 for (i = 0; i < countof(types); i++)
295 {
296 if (strpfx(section, types[i]))
297 {
298 type = types[i];
299 break;
300 }
301 }
302 if (!type)
303 {
304 fprintf(stderr, "ignoring unsupported secret '%s'\n", section);
305 return FALSE;
306 }
307
308 value = cfg->get_str(cfg, "secrets.%s.secret", NULL, section);
309 if (!value)
310 {
311 fprintf(stderr, "missing secret in '%s', ignored\n", section);
312 return FALSE;
313 }
314 if (strcasepfx(value, "0x"))
315 {
316 data = chunk_from_hex(chunk_from_str(value + 2), NULL);
317 }
318 else if (strcasepfx(value, "0s"))
319 {
320 data = chunk_from_base64(chunk_from_str(value + 2), NULL);
321 }
322 else
323 {
324 data = chunk_clone(chunk_from_str(value));
325 }
326
327 req = vici_begin("load-shared");
328
329 vici_add_key_valuef(req, "type", "%s", type);
330 vici_add_key_value(req, "data", data.ptr, data.len);
331 chunk_clear(&data);
332
333 vici_begin_list(req, "owners");
334 snprintf(buf, sizeof(buf), "secrets.%s", section);
335 enumerator = cfg->create_key_value_enumerator(cfg, buf);
336 while (enumerator->enumerate(enumerator, &key, &value))
337 {
338 if (strpfx(key, "id"))
339 {
340 vici_add_list_itemf(req, "%s", value);
341 }
342 }
343 enumerator->destroy(enumerator);
344 vici_end_list(req);
345
346 res = vici_submit(req, conn);
347 if (!res)
348 {
349 fprintf(stderr, "load-shared request failed: %s\n", strerror(errno));
350 return FALSE;
351 }
352 if (raw)
353 {
354 vici_dump(res, "load-shared reply", stdout);
355 }
356 else if (!streq(vici_find_str(res, "no", "success"), "yes"))
357 {
358 fprintf(stderr, "loading shared secret failed: %s\n",
359 vici_find_str(res, "", "errmsg"));
360 ret = FALSE;
361 }
362 else
363 {
364 printf("loaded %s secret '%s'\n", type, section);
365 }
366 vici_free_res(res);
367 return ret;
368 }
369
370 /**
371 * Clear all currently loaded credentials
372 */
373 static bool clear_creds(vici_conn_t *conn, bool raw)
374 {
375 vici_res_t *res;
376
377 res = vici_submit(vici_begin("clear-creds"), conn);
378 if (!res)
379 {
380 fprintf(stderr, "clear-creds request failed: %s\n", strerror(errno));
381 return FALSE;
382 }
383 if (raw)
384 {
385 vici_dump(res, "clear-creds reply", stdout);
386 }
387 vici_free_res(res);
388 return TRUE;
389 }
390
391 static int load_creds(vici_conn_t *conn)
392 {
393 bool raw = FALSE, clear = FALSE, noprompt = FALSE;
394 enumerator_t *enumerator;
395 settings_t *cfg;
396 char *arg, *section;
397
398 while (TRUE)
399 {
400 switch (command_getopt(&arg))
401 {
402 case 'h':
403 return command_usage(NULL);
404 case 'c':
405 clear = TRUE;
406 continue;
407 case 'n':
408 noprompt = TRUE;
409 continue;
410 case 'r':
411 raw = TRUE;
412 continue;
413 case EOF:
414 break;
415 default:
416 return command_usage("invalid --load-creds option");
417 }
418 break;
419 }
420
421 if (clear)
422 {
423 if (!clear_creds(conn, raw))
424 {
425 return ECONNREFUSED;
426 }
427 }
428
429 load_certs(conn, raw, "x509", SWANCTL_X509DIR);
430 load_certs(conn, raw, "x509ca", SWANCTL_X509CADIR);
431 load_certs(conn, raw, "x509aa", SWANCTL_X509AADIR);
432 load_certs(conn, raw, "x509crl", SWANCTL_X509CRLDIR);
433 load_certs(conn, raw, "x509ac", SWANCTL_X509ACDIR);
434
435 load_keys(conn, raw, noprompt, "rsa", SWANCTL_RSADIR);
436 load_keys(conn, raw, noprompt, "ecdsa", SWANCTL_ECDSADIR);
437 load_keys(conn, raw, noprompt, "any", SWANCTL_PKCS8DIR);
438
439 cfg = settings_create(SWANCTL_CONF);
440 if (!cfg)
441 {
442 fprintf(stderr, "parsing '%s' failed\n", SWANCTL_CONF);
443 return EINVAL;
444 }
445
446 enumerator = cfg->create_section_enumerator(cfg, "secrets");
447 while (enumerator->enumerate(enumerator, &section))
448 {
449 load_secret(conn, cfg, section, raw);
450 }
451 enumerator->destroy(enumerator);
452
453 cfg->destroy(cfg);
454
455 return 0;
456 }
457
458 /**
459 * Register the command.
460 */
461 static void __attribute__ ((constructor))reg()
462 {
463 command_register((command_t) {
464 load_creds, 's', "load-creds", "(re-)load credentials",
465 {"[--raw]"},
466 {
467 {"help", 'h', 0, "show usage information"},
468 {"clear", 'c', 0, "clear previously loaded credentials"},
469 {"noprompt", 'n', 0, "do not prompt for passwords"},
470 {"raw", 'r', 0, "dump raw response message"},
471 }
472 });
473 }