src/libcharon/plugins/medcli/medcli_config.c

   1 /*
   2  * Copyright (C) 2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #define _GNU_SOURCE
  17 #include <string.h>
  18
  19 #include "medcli_config.h"
  20
  21 #include <daemon.h>
  22 #include <processing/jobs/callback_job.h>
  23
  24 typedef struct private_medcli_config_t private_medcli_config_t;
  25
  26 /**
  27  * Private data of an medcli_config_t object
  28  */
  29 struct private_medcli_config_t {
  30
  31         /**
  32          * Public part
  33          */
  34         medcli_config_t public;
  35
  36         /**
  37          * database connection
  38          */
  39         database_t *db;
  40
  41         /**
  42          * rekey time
  43          */
  44         int rekey;
  45
  46         /**
  47          * dpd delay
  48          */
  49         int dpd;
  50
  51         /**
  52          * default ike config
  53          */
  54         ike_cfg_t *ike;
  55 };
  56
  57 /**
  58  * create a traffic selector from a CIDR notation string
  59  */
  60 static traffic_selector_t *ts_from_string(char *str)
  61 {
  62         if (str)
  63         {
  64                 traffic_selector_t *ts;
  65
  66                 ts = traffic_selector_create_from_cidr(str, 0, 0);
  67                 if (ts)
  68                 {
  69                         return ts;
  70                 }
  71         }
  72         return traffic_selector_create_dynamic(0, 0, 65535);
  73 }
  74
  75 METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
  76         private_medcli_config_t *this, char *name)
  77 {
  78         enumerator_t *e;
  79         peer_cfg_t *peer_cfg, *med_cfg;
  80         auth_cfg_t *auth;
  81         ike_cfg_t *ike_cfg;
  82         child_cfg_t *child_cfg;
  83         chunk_t me, other;
  84         char *address, *local_net, *remote_net;
  85         lifetime_cfg_t lifetime = {
  86                 .time = {
  87                         .life = this->rekey * 60 + this->rekey,
  88                         .rekey = this->rekey,
  89                         .jitter = this->rekey
  90                 }
  91         };
  92
  93         /* query mediation server config:
  94          * - build ike_cfg/peer_cfg for mediation connection on-the-fly
  95          */
  96         e = this->db->query(this->db,
  97                         "SELECT Address, ClientConfig.KeyId, MediationServerConfig.KeyId "
  98                         "FROM MediationServerConfig JOIN ClientConfig",
  99                         DB_TEXT, DB_BLOB, DB_BLOB);
 100         if (!e || !e->enumerate(e, &address, &me, &other))
 101         {
 102                 DESTROY_IF(e);
 103                 return NULL;
 104         }
 105         ike_cfg = ike_cfg_create(IKEV2, FALSE, FALSE,
 106                                                          "0.0.0.0", FALSE,
 107                                                          charon->socket->get_port(charon->socket, FALSE),
 108                                                          address, FALSE, IKEV2_UDP_PORT, FALSE);
 109         ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
 110         med_cfg = peer_cfg_create(
 111                 "mediation", ike_cfg,
 112                 CERT_NEVER_SEND, UNIQUE_REPLACE,
 113                 1, this->rekey*60, 0,                   /* keytries, rekey, reauth */
 114                 this->rekey*5, this->rekey*3,   /* jitter, overtime */
 115                 TRUE, FALSE,                                    /* mobike, aggressive */
 116                 this->dpd, 0,                                   /* DPD delay, timeout */
 117                 TRUE, NULL, NULL);                              /* mediation, med by, peer id */
 118         e->destroy(e);
 119
 120         auth = auth_cfg_create();
 121         auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 122         auth->add(auth, AUTH_RULE_IDENTITY,
 123                           identification_create_from_encoding(ID_KEY_ID, me));
 124         med_cfg->add_auth_cfg(med_cfg, auth, TRUE);
 125         auth = auth_cfg_create();
 126         auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 127         auth->add(auth, AUTH_RULE_IDENTITY,
 128                           identification_create_from_encoding(ID_KEY_ID, other));
 129         med_cfg->add_auth_cfg(med_cfg, auth, FALSE);
 130
 131         /* query mediated config:
 132          * - use any-any ike_cfg
 133          * - build peer_cfg on-the-fly using med_cfg
 134          * - add a child_cfg
 135          */
 136         e = this->db->query(this->db,
 137                         "SELECT ClientConfig.KeyId, Connection.KeyId, "
 138                         "Connection.LocalSubnet, Connection.RemoteSubnet "
 139                         "FROM ClientConfig JOIN Connection "
 140                         "WHERE Active AND Alias = ?", DB_TEXT, name,
 141                         DB_BLOB, DB_BLOB, DB_TEXT, DB_TEXT);
 142         if (!e || !e->enumerate(e, &me, &other, &local_net, &remote_net))
 143         {
 144                 DESTROY_IF(e);
 145                 return NULL;
 146         }
 147         peer_cfg = peer_cfg_create(
 148                 name, this->ike->get_ref(this->ike),
 149                 CERT_NEVER_SEND, UNIQUE_REPLACE,
 150                 1, this->rekey*60, 0,                   /* keytries, rekey, reauth */
 151                 this->rekey*5, this->rekey*3,   /* jitter, overtime */
 152                 TRUE, FALSE,                                    /* mobike, aggressive */
 153                 this->dpd, 0,                                   /* DPD delay, timeout */
 154                 FALSE, med_cfg,                                 /* mediation, med by */
 155                 identification_create_from_encoding(ID_KEY_ID, other));
 156
 157         auth = auth_cfg_create();
 158         auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 159         auth->add(auth, AUTH_RULE_IDENTITY,
 160                           identification_create_from_encoding(ID_KEY_ID, me));
 161         peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
 162         auth = auth_cfg_create();
 163         auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 164         auth->add(auth, AUTH_RULE_IDENTITY,
 165                           identification_create_from_encoding(ID_KEY_ID, other));
 166         peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
 167
 168         child_cfg = child_cfg_create(name, &lifetime, NULL, TRUE, MODE_TUNNEL,
 169                                                                  ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
 170                                                                  0, 0, NULL, NULL, 0);
 171         child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
 172         child_cfg->add_traffic_selector(child_cfg, TRUE, ts_from_string(local_net));
 173         child_cfg->add_traffic_selector(child_cfg, FALSE, ts_from_string(remote_net));
 174         peer_cfg->add_child_cfg(peer_cfg, child_cfg);
 175         e->destroy(e);
 176         return peer_cfg;
 177 }
 178
 179 METHOD(backend_t, create_ike_cfg_enumerator, enumerator_t*,
 180         private_medcli_config_t *this, host_t *me, host_t *other)
 181 {
 182         return enumerator_create_single(this->ike, NULL);
 183 }
 184
 185 typedef struct {
 186         /** implements enumerator */
 187         enumerator_t public;
 188         /** inner SQL enumerator */
 189         enumerator_t *inner;
 190         /** currently enumerated peer config */
 191         peer_cfg_t *current;
 192         /** ike cfg to use in peer cfg */
 193         ike_cfg_t *ike;
 194         /** rekey time */
 195         int rekey;
 196         /** dpd time */
 197         int dpd;
 198 } peer_enumerator_t;
 199
 200 METHOD(enumerator_t, peer_enumerator_enumerate, bool,
 201         peer_enumerator_t *this, peer_cfg_t **cfg)
 202 {
 203         char *name, *local_net, *remote_net;
 204         chunk_t me, other;
 205         child_cfg_t *child_cfg;
 206         auth_cfg_t *auth;
 207         lifetime_cfg_t lifetime = {
 208                 .time = {
 209                         .life = this->rekey * 60 + this->rekey,
 210                         .rekey = this->rekey,
 211                         .jitter = this->rekey
 212                 }
 213         };
 214
 215         DESTROY_IF(this->current);
 216         if (!this->inner->enumerate(this->inner, &name, &me, &other,
 217                                                                 &local_net, &remote_net))
 218         {
 219                 this->current = NULL;
 220                 return FALSE;
 221         }
 222         this->current = peer_cfg_create(
 223                                 name, this->ike->get_ref(this->ike),
 224                                 CERT_NEVER_SEND, UNIQUE_REPLACE,
 225                                 1, this->rekey*60, 0,                   /* keytries, rekey, reauth */
 226                                 this->rekey*5, this->rekey*3,   /* jitter, overtime */
 227                                 TRUE, FALSE,                                    /* mobike, aggressive */
 228                                 this->dpd, 0,                                   /* DPD delay, timeout */
 229                                 FALSE, NULL, NULL);                             /* mediation, med by, peer id */
 230
 231         auth = auth_cfg_create();
 232         auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 233         auth->add(auth, AUTH_RULE_IDENTITY,
 234                           identification_create_from_encoding(ID_KEY_ID, me));
 235         this->current->add_auth_cfg(this->current, auth, TRUE);
 236         auth = auth_cfg_create();
 237         auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 238         auth->add(auth, AUTH_RULE_IDENTITY,
 239                           identification_create_from_encoding(ID_KEY_ID, other));
 240         this->current->add_auth_cfg(this->current, auth, FALSE);
 241
 242         child_cfg = child_cfg_create(name, &lifetime, NULL, TRUE, MODE_TUNNEL,
 243                                                                  ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
 244                                                                  0, 0, NULL, NULL, 0);
 245         child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
 246         child_cfg->add_traffic_selector(child_cfg, TRUE, ts_from_string(local_net));
 247         child_cfg->add_traffic_selector(child_cfg, FALSE, ts_from_string(remote_net));
 248         this->current->add_child_cfg(this->current, child_cfg);
 249         *cfg = this->current;
 250         return TRUE;
 251 }
 252
 253 METHOD(enumerator_t, peer_enumerator_destroy, void,
 254         peer_enumerator_t *this)
 255 {
 256         DESTROY_IF(this->current);
 257         this->inner->destroy(this->inner);
 258         free(this);
 259 }
 260
 261 METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*,
 262         private_medcli_config_t *this, identification_t *me,
 263         identification_t *other)
 264 {
 265         peer_enumerator_t *e;
 266
 267         INIT(e,
 268                 .public = {
 269                         .enumerate = (void*)_peer_enumerator_enumerate,
 270                         .destroy = _peer_enumerator_destroy,
 271                 },
 272                 .ike = this->ike,
 273                 .rekey = this->rekey,
 274                 .dpd = this->dpd,
 275         );
 276
 277         /* filter on IDs: NULL or ANY or matching KEY_ID */
 278         e->inner = this->db->query(this->db,
 279                         "SELECT Alias, ClientConfig.KeyId, Connection.KeyId, "
 280                         "Connection.LocalSubnet, Connection.RemoteSubnet "
 281                         "FROM ClientConfig JOIN Connection "
 282                         "WHERE Active AND "
 283                         "(? OR ClientConfig.KeyId = ?) AND (? OR Connection.KeyId = ?)",
 284                         DB_INT, me == NULL || me->get_type(me) == ID_ANY,
 285                         DB_BLOB, me && me->get_type(me) == ID_KEY_ID ?
 286                                 me->get_encoding(me) : chunk_empty,
 287                         DB_INT, other == NULL || other->get_type(other) == ID_ANY,
 288                         DB_BLOB, other && other->get_type(other) == ID_KEY_ID ?
 289                                 other->get_encoding(other) : chunk_empty,
 290                         DB_TEXT, DB_BLOB, DB_BLOB, DB_TEXT, DB_TEXT);
 291         if (!e->inner)
 292         {
 293                 free(e);
 294                 return NULL;
 295         }
 296         return &e->public;
 297 }
 298
 299 /**
 300  * initiate a peer config
 301  */
 302 static job_requeue_t initiate_config(peer_cfg_t *peer_cfg)
 303 {
 304         enumerator_t *enumerator;
 305         child_cfg_t *child_cfg = NULL;;
 306
 307         enumerator = peer_cfg->create_child_cfg_enumerator(peer_cfg);
 308         enumerator->enumerate(enumerator, &child_cfg);
 309         if (child_cfg)
 310         {
 311                 child_cfg->get_ref(child_cfg);
 312                 peer_cfg->get_ref(peer_cfg);
 313                 enumerator->destroy(enumerator);
 314                 charon->controller->initiate(charon->controller,
 315                                                                          peer_cfg, child_cfg, NULL, NULL, 0);
 316         }
 317         else
 318         {
 319                 enumerator->destroy(enumerator);
 320         }
 321         return JOB_REQUEUE_NONE;
 322 }
 323
 324 /**
 325  * schedule initiation of all "active" connections
 326  */
 327 static void schedule_autoinit(private_medcli_config_t *this)
 328 {
 329         enumerator_t *e;
 330         char *name;
 331
 332         e = this->db->query(this->db, "SELECT Alias FROM Connection WHERE Active",
 333                                                 DB_TEXT);
 334         if (e)
 335         {
 336                 while (e->enumerate(e, &name))
 337                 {
 338                         peer_cfg_t *peer_cfg;
 339
 340                         peer_cfg = get_peer_cfg_by_name(this, name);
 341                         if (peer_cfg)
 342                         {
 343                                 /* schedule asynchronous initiation job */
 344                                 lib->processor->queue_job(lib->processor,
 345                                                 (job_t*)callback_job_create(
 346                                                                         (callback_job_cb_t)initiate_config,
 347                                                                         peer_cfg, (void*)peer_cfg->destroy, NULL));
 348                         }
 349                 }
 350                 e->destroy(e);
 351         }
 352 }
 353
 354 METHOD(medcli_config_t, destroy, void,
 355         private_medcli_config_t *this)
 356 {
 357         this->ike->destroy(this->ike);
 358         free(this);
 359 }
 360
 361 /**
 362  * Described in header.
 363  */
 364 medcli_config_t *medcli_config_create(database_t *db)
 365 {
 366         private_medcli_config_t *this;
 367
 368         INIT(this,
 369                 .public = {
 370                         .backend = {
 371                                 .create_peer_cfg_enumerator = _create_peer_cfg_enumerator,
 372                                 .create_ike_cfg_enumerator = _create_ike_cfg_enumerator,
 373                                 .get_peer_cfg_by_name = _get_peer_cfg_by_name,
 374                         },
 375                         .destroy = _destroy,
 376                 },
 377                 .db = db,
 378                 .rekey = lib->settings->get_time(lib->settings, "medcli.rekey", 1200),
 379                 .dpd = lib->settings->get_time(lib->settings, "medcli.dpd", 300),
 380                 .ike = ike_cfg_create(IKEV2, FALSE, FALSE,
 381                                                           "0.0.0.0", FALSE,
 382                                                           charon->socket->get_port(charon->socket, FALSE),
 383                                                           "0.0.0.0", FALSE, IKEV2_UDP_PORT, FALSE),
 384         );
 385         this->ike->add_proposal(this->ike, proposal_create_default(PROTO_IKE));
 386
 387         schedule_autoinit(this);
 388
 389         return &this->public;
 390 }
 391