diff options
Diffstat (limited to 'Source')
| -rwxr-xr-x | Source/charon/threads/stroke.c | 601 | ||||
| -rw-r--r-- | Source/charon/threads/stroke.h | 142 |
2 files changed, 743 insertions, 0 deletions
diff --git a/Source/charon/threads/stroke.c b/Source/charon/threads/stroke.c new file mode 100755 index 000000000..9dad95d3c --- /dev/null +++ b/Source/charon/threads/stroke.c @@ -0,0 +1,601 @@ +/** + * @file stroke.c + * + * @brief Implementation of stroke_t. + * + */ + +/* + * Copyright (C) 2006 Martin Willi + * Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include <stdlib.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <sys/socket.h> +#include <sys/un.h> +#include <sys/fcntl.h> +#include <unistd.h> +#include <errno.h> +#include <pthread.h> + +#include "stroke.h" + +#include <types.h> +#include <daemon.h> +#include <utils/allocator.h> +#include <queues/jobs/initiate_ike_sa_job.h> + + +struct sockaddr_un socket_addr = { AF_UNIX, STROKE_SOCKET}; + +typedef struct configuration_entry_t configuration_entry_t; + +/** + * A configuration entry combines a configuration name with a connection + * and a policy. + * + * @b Constructors: + * - configuration_entry_create() + */ +struct configuration_entry_t { + + /** + * Configuration name. + * + */ + char *name; + + /** + * Configuration for IKE_SA_INIT exchange. + */ + connection_t *connection; + + /** + * Configuration for all phases after IKE_SA_INIT exchange. + */ + policy_t *policy; + + /** + * Destroys a configuration_entry_t + */ + void (*destroy) (configuration_entry_t *this); +}; + +/** + * Implementation of configuration_entry_t.destroy. + */ +static void configuration_entry_destroy (configuration_entry_t *this) +{ + this->connection->destroy(this->connection); + this->policy->destroy(this->policy); + allocator_free(this->name); + allocator_free(this); +} + +/** + * Creates a configuration_entry_t object. + */ +static configuration_entry_t * configuration_entry_create(char *name, connection_t* connection, policy_t *policy) +{ + configuration_entry_t *entry = allocator_alloc_thing(configuration_entry_t); + + /* functions */ + entry->destroy = configuration_entry_destroy; + + /* private data */ + entry->connection = connection; + entry->policy = policy; + entry->name = allocator_alloc(strlen(name) + 1); + strcpy(entry->name, name); + + return entry; +} + +typedef struct private_stroke_t private_stroke_t; + +/** + * Private data of an stroke_t object. + */ +struct private_stroke_t { + + /** + * Public part of stroke_t object. + */ + stroke_t public; + + /** + * Holding all configurations. + */ + linked_list_t *configurations; + + /** + * Assigned logger_t object. + */ + logger_t *logger; + + /** + * Unix socket to use for communication + */ + int socket; + + /** + * Thread which reads from the socket + */ + pthread_t assigned_thread; + + /** + * Read from the socket and handle stroke messages + */ + void (*stroke_receive) (private_stroke_t *this); + + /** + * find a connection in the config list by name + */ + connection_t *(*get_connection_by_name) (private_stroke_t *this, char *name); +}; + +/** + * Helper function which corrects the string pointers + * in a stroke_msg_t. Strings in a stroke_msg sent over wire + * contain RELATIVE addresses (relative to the beginning of the + * stroke_msg). They must be corrected if they reach our address + * space... + */ +static void fix_string(stroke_msg_t *msg, char **string) +{ + /* check for sanity of string pointer and string */ + if (string < (char**)msg || + string > (char**)msg + sizeof(stroke_msg_t) || + *string < (char*)msg->buffer - (u_int)msg || + *string > (char*)(u_int)msg->length) + { + *string = "(invalid char* in stroke msg)"; + } + else + { + *string = (char*)msg + (u_int)*string; + } +} + +/** + * Implementation of private_stroke_t.stroke_receive. + */ +static void stroke_receive(private_stroke_t *this) +{ + stroke_msg_t *msg; + u_int16_t msg_length; + struct sockaddr_un strokeaddr; + int strokeaddrlen = sizeof(strokeaddr); + ssize_t bytes_read; + int strokefd; + + while (1) + { + strokefd = accept(this->socket, (struct sockaddr *)&strokeaddr, &strokeaddrlen); + + if (strokefd < 0) + { + this->logger->log(this->logger, ERROR, "accepting stroke connection failed"); + continue; + } + + /* peek the length */ + bytes_read = recv(strokefd, &msg_length, sizeof(msg_length), MSG_PEEK); + if (bytes_read != sizeof(msg_length)) + { + this->logger->log(this->logger, ERROR, "reading lenght of stroke message failed"); + close(strokefd); + continue; + } + + /* read message */ + msg = allocator_alloc(msg_length); + bytes_read = recv(strokefd, msg, msg_length, 0); + if (bytes_read != msg_length) + { + this->logger->log(this->logger, ERROR, "reading stroke message failed"); + close(strokefd); + continue; + } + + this->logger->log_bytes(this->logger, RAW|LEVEL1, "stroke message", (void*)msg, msg_length); + + switch (msg->type) + { + case STR_INITIATE: + { + initiate_ike_sa_job_t *job; + connection_t *connection; + fix_string(msg, &(msg->initiate.name)); + this->logger->log(this->logger, CONTROL|LEVEL1, "received stroke: initiate \"%s\"", msg->initiate.name); + connection = this->get_connection_by_name(this, msg->initiate.name); + if (connection == NULL) + { + this->logger->log(this->logger, ERROR, "could not find a connection named \"%s\"", msg->initiate.name); + } + else + { + job = initiate_ike_sa_job_create(connection); + charon->job_queue->add(charon->job_queue, (job_t*)job); + } + break; + } + case STR_INSTALL: + { + fix_string(msg, &(msg->install.name)); + this->logger->log(this->logger, CONTROL|LEVEL1, "received stroke: install \"%s\"", msg->install.name); + break; + } + case STR_ADD_CONN: + { + connection_t *connection; + policy_t *policy; + identification_t *my_id, *other_id; + host_t *my_host, *other_host, *my_subnet, *other_subnet; + proposal_t *proposal; + traffic_selector_t *ts; + chunk_t chunk; + + fix_string(msg, &msg->add_conn.name); + this->logger->log(this->logger, CONTROL|LEVEL1, "received stroke: add connection \"%s\"", msg->add_conn.name); + + msg->add_conn.me.address.v4.sin_port = htons(500); + msg->add_conn.other.address.v4.sin_port = htons(500); + my_host = host_create_from_sockaddr(&msg->add_conn.me.address.saddr); + other_host = host_create_from_sockaddr(&msg->add_conn.other.address.saddr); + + fix_string(msg, &msg->add_conn.me.id); + fix_string(msg, &msg->add_conn.other.id); + my_id = identification_create_from_string(ID_IPV4_ADDR, msg->add_conn.me.id); + other_id = identification_create_from_string(ID_IPV4_ADDR, msg->add_conn.other.id); + + connection = connection_create(my_host, other_host, my_id->clone(my_id), other_id->clone(other_id), SHARED_KEY_MESSAGE_INTEGRITY_CODE); + proposal = proposal_create(1); + proposal->add_algorithm(proposal, IKE, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16); + proposal->add_algorithm(proposal, IKE, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 0); + proposal->add_algorithm(proposal, IKE, PSEUDO_RANDOM_FUNCTION, PRF_HMAC_SHA1, 0); + proposal->add_algorithm(proposal, IKE, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0); + connection->add_proposal(connection, proposal); + + policy = policy_create(my_id, other_id); + proposal = proposal_create(1); + proposal->add_algorithm(proposal, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16); + proposal->add_algorithm(proposal, ESP, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 0); + policy->add_proposal(policy, proposal); + + my_subnet = host_create_from_sockaddr(&msg->add_conn.me.subnet.saddr); + ts = traffic_selector_create_from_subnet(my_subnet, msg->add_conn.me.subnet_netbits); + my_subnet->destroy(my_subnet); + policy->add_my_traffic_selector(policy, ts); + + other_subnet = host_create_from_sockaddr(&msg->add_conn.other.subnet.saddr); + ts = traffic_selector_create_from_subnet(other_subnet, msg->add_conn.other.subnet_netbits); + other_subnet->destroy(other_subnet); + policy->add_other_traffic_selector(policy, ts); + + this->configurations->insert_last(this->configurations, + configuration_entry_create(msg->add_conn.name, connection, policy)); + + this->logger->log(this->logger, CONTROL|LEVEL1, "connection \"%s\" added (%d in store)", + msg->add_conn.name, + this->configurations->get_count(this->configurations)); + + break; + } + case STR_DEL_CONN: + default: + this->logger->log(this->logger, ERROR, "received invalid stroke"); + } + + allocator_free(msg); + } +} + + +/** + * Implementation of connection_store_t.get_connection_by_hosts. + */ +static connection_t *get_connection_by_hosts(connection_store_t *store, host_t *my_host, host_t *other_host) +{ + private_stroke_t *this = (private_stroke_t*)((u_int8_t*)store - offsetof(stroke_t, connections)); + iterator_t *iterator; + connection_t *found = NULL; + + this->logger->log(this->logger, CONTROL|LEVEL1, "getting config for hosts %s - %s", + my_host->get_address(my_host), other_host->get_address(other_host)); + + iterator = this->configurations->create_iterator(this->configurations,TRUE); + while (iterator->has_next(iterator)) + { + configuration_entry_t *entry; + host_t *config_my_host, *config_other_host; + + iterator->current(iterator,(void **) &entry); + + config_my_host = entry->connection->get_my_host(entry->connection); + config_other_host = entry->connection->get_other_host(entry->connection); + + /* first check if ip is equal */ + if(config_other_host->ip_is_equal(config_other_host, other_host)) + { + this->logger->log(this->logger, CONTROL|LEVEL2, "config entry with remote host %s", + config_other_host->get_address(config_other_host)); + /* could be right one, check my_host for default route*/ + if (config_my_host->is_default_route(config_my_host)) + { + found = entry->connection; + break; + } + /* check now if host informations are the same */ + else if (config_my_host->ip_is_equal(config_my_host,my_host)) + { + found = entry->connection; + break; + } + + } + /* Then check for wildcard hosts! + * TODO + * actually its only checked if other host with default route can be found! */ + else if (config_other_host->is_default_route(config_other_host)) + { + /* could be right one, check my_host for default route*/ + if (config_my_host->is_default_route(config_my_host)) + { + found = entry->connection; + break; + } + /* check now if host informations are the same */ + else if (config_my_host->ip_is_equal(config_my_host,my_host)) + { + found = entry->connection; + break; + } + } + } + iterator->destroy(iterator); + + return found; +} + +/** + * Implementation of connection_store_t.get_connection_by_ids. + */ +static connection_t *get_connection_by_ids(connection_store_t *store, identification_t *my_id, identification_t *other_id) +{ + private_stroke_t *this = (private_stroke_t*)((u_int8_t*)store - offsetof(stroke_t, connections)); + iterator_t *iterator; + connection_t *found = NULL; + + this->logger->log(this->logger, CONTROL|LEVEL1, "getting config for ids %s - %s", + my_id->get_string(my_id), other_id->get_string(other_id)); + + iterator = this->configurations->create_iterator(this->configurations,TRUE); + while (iterator->has_next(iterator)) + { + configuration_entry_t *entry; + identification_t *config_my_id, *config_other_id; + + iterator->current(iterator,(void **) &entry); + + config_my_id = entry->connection->get_my_id(entry->connection); + config_other_id = entry->connection->get_other_id(entry->connection); + + /* first check if ids are equal + * TODO: Add wildcard checks */ + if (config_other_id->equals(config_other_id, other_id) && + config_my_id->equals(config_my_id, my_id)) + { + this->logger->log(this->logger, CONTROL|LEVEL2, "config entry with remote id %s", + config_other_id->get_string(config_other_id)); + found = entry->connection; + break; + } + } + iterator->destroy(iterator); + + return found; +} + +/** + * Implementation of private_stroke_t.get_connection_by_name. + */ +static connection_t *get_connection_by_name(private_stroke_t *this, char *name) +{ + iterator_t *iterator; + connection_t *found = NULL; + + iterator = this->configurations->create_iterator(this->configurations, TRUE); + while (iterator->has_next(iterator)) + { + configuration_entry_t *entry; + iterator->current(iterator,(void **) &entry); + + if (strcmp(entry->name,name) == 0) + { + /* found configuration */ + found = entry->connection; + break; + } + } + iterator->destroy(iterator); + + return found; +} + +/** + * Implementation of policy_store_t.get_policy. + */ +static policy_t *get_policy(policy_store_t *store,identification_t *my_id, identification_t *other_id) +{ + private_stroke_t *this = (private_stroke_t*)((u_int8_t*)store - offsetof(stroke_t, policies)); + iterator_t *iterator; + policy_t *found = NULL; + + iterator = this->configurations->create_iterator(this->configurations, TRUE); + while (iterator->has_next(iterator)) + { + configuration_entry_t *entry; + iterator->current(iterator,(void **) &entry); + identification_t *config_my_id = entry->policy->get_my_id(entry->policy); + identification_t *config_other_id = entry->policy->get_other_id(entry->policy); + + /* host informations seem to be the same */ + if (config_other_id->equals(config_other_id, other_id)) + { + /* other ids seems to match */ + if (my_id == NULL) + { + /* first matching one is selected */ + /* TODO priorize found entries */ + found = entry->policy; + break; + } + + if (config_my_id->equals(config_my_id, my_id)) + { + found = entry->policy; + break; + } + + } + } + iterator->destroy(iterator); + + return found; +} + + +static status_t get_shared_secret(credential_store_t *this, identification_t *identification, chunk_t *preshared_secret) +{ + char *secret = "schluessel"; + preshared_secret->ptr = secret; + preshared_secret->len = strlen(secret) + 1; + return SUCCESS; +} + +static status_t get_rsa_public_key(credential_store_t *this, identification_t *identification, rsa_public_key_t **public_key) +{ + return FAILED; +} + +static status_t get_rsa_private_key(credential_store_t *this, identification_t *identification, rsa_private_key_t **private_key) +{ + return FAILED; +} + + + + +/** + * Implementation of stroke_t.destroy. + */ +static void destroy(private_stroke_t *this) +{ + configuration_entry_t *entry; + while (this->configurations->remove_first(this->configurations, (void **)&entry) == SUCCESS) + { + entry->destroy(entry); + } + this->configurations->destroy(this->configurations); + + charon->logger_manager->destroy_logger(charon->logger_manager,this->logger); + close(this->socket); + unlink(socket_addr.sun_path); + allocator_free(this); +} + +/** + * Dummy function which does nothing. + * Used for connection_store_t.destroy and policy_store_t.destroy, + * since destruction is done in store_t's destructor... + */ +void do_nothing(void *nothing) +{ + return; +} + +/* + * Described in header-file + */ +stroke_t *stroke_create() +{ + private_stroke_t *this = allocator_alloc_thing(private_stroke_t); + mode_t old; + + /* public functions */ + this->public.connections.get_connection_by_ids = get_connection_by_ids; + this->public.connections.get_connection_by_hosts = get_connection_by_hosts; + this->public.connections.destroy = (void (*) (connection_store_t*))do_nothing; + this->public.policies.get_policy = get_policy; + this->public.policies.destroy = (void (*) (policy_store_t*))do_nothing; + this->public.credentials.get_shared_secret = (status_t (*)(credential_store_t*,identification_t*,chunk_t*))get_shared_secret; + this->public.credentials.get_rsa_public_key = (status_t (*)(credential_store_t*,identification_t*,rsa_public_key_t**))get_rsa_public_key; + this->public.credentials.get_rsa_private_key = (status_t (*)(credential_store_t*,identification_t*,rsa_private_key_t**))get_rsa_private_key; + this->public.credentials.destroy = (void (*) (credential_store_t*))do_nothing; + this->public.destroy = (void (*)(stroke_t*))destroy; + + /* private functions */ + this->stroke_receive = stroke_receive; + this->get_connection_by_name = get_connection_by_name; + + this->logger = charon->logger_manager->create_logger(charon->logger_manager,CONFIG,NULL); + + /* set up unix socket */ + this->socket = socket(AF_UNIX, SOCK_STREAM, 0); + if (this->socket == -1) + { + this->logger->log(this->logger, ERROR, "could not create whack socket"); + charon->logger_manager->destroy_logger(charon->logger_manager,this->logger); + allocator_free(this); + return NULL; + } + + old = umask(~S_IRWXU); + if (bind(this->socket, (struct sockaddr *)&socket_addr, sizeof(socket_addr)) < 0) + { + this->logger->log(this->logger, ERROR, "could not bind stroke socket: %s", strerror(errno)); + charon->logger_manager->destroy_logger(charon->logger_manager,this->logger); + close(this->socket); + allocator_free(this); + return NULL; + } + umask(old); + + if (listen(this->socket, 0) < 0) + { + this->logger->log(this->logger, ERROR, "could not listen on stroke socket: %s", strerror(errno)); + charon->logger_manager->destroy_logger(charon->logger_manager,this->logger); + close(this->socket); + unlink(socket_addr.sun_path); + allocator_free(this); + return NULL; + } + + /* start a thread reading from the socket */ + if (pthread_create(&(this->assigned_thread), NULL, (void*(*)(void*))this->stroke_receive, this) != 0) + { + this->logger->log(this->logger, ERROR, "Could not spawn stroke thread"); + charon->logger_manager->destroy_logger(charon->logger_manager, this->logger); + close(this->socket); + unlink(socket_addr.sun_path); + allocator_free(this); + } + + /* private variables */ + this->configurations = linked_list_create(); + + return (&this->public); +} diff --git a/Source/charon/threads/stroke.h b/Source/charon/threads/stroke.h new file mode 100644 index 000000000..4fc0fe5e7 --- /dev/null +++ b/Source/charon/threads/stroke.h @@ -0,0 +1,142 @@ +/** + * @file stroke.h + * + * @brief Interface of stroke_t. + * + */ + +/* + * Copyright (C) 2006 Martin Willi + * Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#ifndef STROKE_H_ +#define STROKE_H_ + +#include <config/policy_store.h> +#include <config/connection_store.h> +#include <config/credential_store.h> + + +#define STROKE_SOCKET "/var/run/charon.ctl" + +/** + * @brief A stroke message sent over the unix socket. + * + */ +typedef struct stroke_msg_t stroke_msg_t; + +struct stroke_msg_t { + /* length of this message with all strings */ + u_int16_t length; + /* type of the message */ + enum { + /* initiate a connection */ + STR_INITIATE, + /* install SPD entries for a connection */ + STR_INSTALL, + /* add a connection */ + STR_ADD_CONN, + /* delete a connection */ + STR_DEL_CONN, + /* more to come */ + } type; + union { + /* data for STR_INITIATE, STR_INSTALL */ + struct { + char *name; + } initiate, install; + /* data for STR_ADD_CONN */ + struct { + char *name; + struct { + union { + u_int16_t family; + struct sockaddr saddr; + struct sockaddr_in v4; + struct sockaddr_in6 v6; + } address; + char *id; + union { + u_int16_t family; + struct sockaddr saddr; + struct sockaddr_in v4; + struct sockaddr_in6 v6; + } subnet; + u_int8_t subnet_netbits; + } me, other; + } add_conn; + }; + u_int8_t buffer[]; +}; + + +typedef struct stroke_t stroke_t; + +/** + * @brief Stroke is a configuration and control interface which + * allows other processes to modify charons behavior. + * + * stroke_t allows config manipulation (as whack in pluto). + * Messages of type stroke_msg_t's are sent over a unix socket + * (/var/run/charon.ctl). stroke_t implements the connections_t + * and the policies_t interface, which means it acts as a + * configuration backend for those too. stroke_t uses an own + * thread to read from the socket. + * + * @warning DO NOT cast stroke_t to any of the implemented interfaces! + * stroke_t implements multiple interfaces, so you must use + * stroke_t.interface_xy to access the specific interface! You have + * been warned... + * + * @b Constructors: + * - stroke_create() + * + * @ingroup config + */ +struct stroke_t { + + /** + * Implements connection_store_t interface + */ + connection_store_t connections; + + /** + * Implements policy_store_t interface + */ + policy_store_t policies; + + /** + * Implements credential_store_t interfacce + */ + credential_store_t credentials; + + /** + * @brief Destroy a stroke_t instance. + * + * @param this stroke_t objec to destroy + */ + void (*destroy) (stroke_t *this); +}; + + +/** + * @brief Create the stroke interface and listen on the socket. + * + * @return stroke_t object + * + * @ingroup config + */ +stroke_t *stroke_create(); + +#endif /* STROKE_H_ */ |