2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
19 #include "medcli_config.h"
22 #include <processing/jobs/callback_job.h>
24 typedef struct private_medcli_config_t private_medcli_config_t
;
27 * Private data of an medcli_config_t object
29 struct private_medcli_config_t
{
34 medcli_config_t
public;
58 * create a traffic selector from a CIDR notation string
60 static traffic_selector_t
*ts_from_string(char *str
)
69 pos
= strchr(str
, '/');
82 net
= host_create_from_string(str
, 0);
85 return traffic_selector_create_from_subnet(net
, netbits
, 0, 0);
88 return traffic_selector_create_dynamic(0, 0, 65535);
92 * implements backend_t.get_peer_cfg_by_name.
94 static peer_cfg_t
*get_peer_cfg_by_name(private_medcli_config_t
*this, char *name
)
97 peer_cfg_t
*peer_cfg
, *med_cfg
;
100 child_cfg_t
*child_cfg
;
102 char *address
, *local_net
, *remote_net
;
103 lifetime_cfg_t lifetime
= {
105 .life
= this->rekey
* 60 + this->rekey
,
106 .rekey
= this->rekey
,
107 .jitter
= this->rekey
111 /* query mediation server config:
112 * - build ike_cfg/peer_cfg for mediation connection on-the-fly
114 e
= this->db
->query(this->db
,
115 "SELECT Address, ClientConfig.KeyId, MediationServerConfig.KeyId "
116 "FROM MediationServerConfig JOIN ClientConfig",
117 DB_TEXT
, DB_BLOB
, DB_BLOB
);
118 if (!e
|| !e
->enumerate(e
, &address
, &me
, &other
))
123 ike_cfg
= ike_cfg_create(FALSE
, FALSE
,
124 "0.0.0.0", IKEV2_UDP_PORT
, address
, IKEV2_UDP_PORT
);
125 ike_cfg
->add_proposal(ike_cfg
, proposal_create_default(PROTO_IKE
));
126 med_cfg
= peer_cfg_create(
127 "mediation", 2, ike_cfg
,
128 CERT_NEVER_SEND
, UNIQUE_REPLACE
,
129 1, this->rekey
*60, 0, /* keytries, rekey, reauth */
130 this->rekey
*5, this->rekey
*3, /* jitter, overtime */
131 TRUE
, this->dpd
, /* mobike, dpddelay */
132 NULL
, NULL
, /* vip, pool */
133 TRUE
, NULL
, NULL
); /* mediation, med by, peer id */
136 auth
= auth_cfg_create();
137 auth
->add(auth
, AUTH_RULE_AUTH_CLASS
, AUTH_CLASS_PUBKEY
);
138 auth
->add(auth
, AUTH_RULE_IDENTITY
,
139 identification_create_from_encoding(ID_KEY_ID
, me
));
140 med_cfg
->add_auth_cfg(med_cfg
, auth
, TRUE
);
141 auth
= auth_cfg_create();
142 auth
->add(auth
, AUTH_RULE_AUTH_CLASS
, AUTH_CLASS_PUBKEY
);
143 auth
->add(auth
, AUTH_RULE_IDENTITY
,
144 identification_create_from_encoding(ID_KEY_ID
, other
));
145 med_cfg
->add_auth_cfg(med_cfg
, auth
, FALSE
);
147 /* query mediated config:
148 * - use any-any ike_cfg
149 * - build peer_cfg on-the-fly using med_cfg
152 e
= this->db
->query(this->db
,
153 "SELECT ClientConfig.KeyId, Connection.KeyId, "
154 "Connection.LocalSubnet, Connection.RemoteSubnet "
155 "FROM ClientConfig JOIN Connection "
156 "WHERE Active AND Alias = ?", DB_TEXT
, name
,
157 DB_BLOB
, DB_BLOB
, DB_TEXT
, DB_TEXT
);
158 if (!e
|| !e
->enumerate(e
, &me
, &other
, &local_net
, &remote_net
))
163 peer_cfg
= peer_cfg_create(
164 name
, 2, this->ike
->get_ref(this->ike
),
165 CERT_NEVER_SEND
, UNIQUE_REPLACE
,
166 1, this->rekey
*60, 0, /* keytries, rekey, reauth */
167 this->rekey
*5, this->rekey
*3, /* jitter, overtime */
168 TRUE
, this->dpd
, /* mobike, dpddelay */
169 NULL
, NULL
, /* vip, pool */
170 FALSE
, med_cfg
, /* mediation, med by */
171 identification_create_from_encoding(ID_KEY_ID
, other
));
173 auth
= auth_cfg_create();
174 auth
->add(auth
, AUTH_RULE_AUTH_CLASS
, AUTH_CLASS_PUBKEY
);
175 auth
->add(auth
, AUTH_RULE_IDENTITY
,
176 identification_create_from_encoding(ID_KEY_ID
, me
));
177 peer_cfg
->add_auth_cfg(peer_cfg
, auth
, TRUE
);
178 auth
= auth_cfg_create();
179 auth
->add(auth
, AUTH_RULE_AUTH_CLASS
, AUTH_CLASS_PUBKEY
);
180 auth
->add(auth
, AUTH_RULE_IDENTITY
,
181 identification_create_from_encoding(ID_KEY_ID
, other
));
182 peer_cfg
->add_auth_cfg(peer_cfg
, auth
, FALSE
);
184 child_cfg
= child_cfg_create(name
, &lifetime
, NULL
, TRUE
, MODE_TUNNEL
,
185 ACTION_NONE
, ACTION_NONE
, FALSE
, 0, 0, NULL
);
186 child_cfg
->add_proposal(child_cfg
, proposal_create_default(PROTO_ESP
));
187 child_cfg
->add_traffic_selector(child_cfg
, TRUE
, ts_from_string(local_net
));
188 child_cfg
->add_traffic_selector(child_cfg
, FALSE
, ts_from_string(remote_net
));
189 peer_cfg
->add_child_cfg(peer_cfg
, child_cfg
);
195 * Implementation of backend_t.create_ike_cfg_enumerator.
197 static enumerator_t
* create_ike_cfg_enumerator(private_medcli_config_t
*this,
198 host_t
*me
, host_t
*other
)
200 return enumerator_create_single(this->ike
, NULL
);
204 /** implements enumerator */
206 /** inner SQL enumerator */
208 /** currently enumerated peer config */
210 /** ike cfg to use in peer cfg */
219 * Implementation of peer_enumerator_t.public.enumerate
221 static bool peer_enumerator_enumerate(peer_enumerator_t
*this, peer_cfg_t
**cfg
)
223 char *name
, *local_net
, *remote_net
;
225 child_cfg_t
*child_cfg
;
227 lifetime_cfg_t lifetime
= {
229 .life
= this->rekey
* 60 + this->rekey
,
230 .rekey
= this->rekey
,
231 .jitter
= this->rekey
235 DESTROY_IF(this->current
);
236 if (!this->inner
->enumerate(this->inner
, &name
, &me
, &other
,
237 &local_net
, &remote_net
))
239 this->current
= NULL
;
242 this->current
= peer_cfg_create(
243 name
, 2, this->ike
->get_ref(this->ike
),
244 CERT_NEVER_SEND
, UNIQUE_REPLACE
,
245 1, this->rekey
*60, 0, /* keytries, rekey, reauth */
246 this->rekey
*5, this->rekey
*3, /* jitter, overtime */
247 TRUE
, this->dpd
, /* mobike, dpddelay */
248 NULL
, NULL
, /* vip, pool */
249 FALSE
, NULL
, NULL
); /* mediation, med by, peer id */
251 auth
= auth_cfg_create();
252 auth
->add(auth
, AUTH_RULE_AUTH_CLASS
, AUTH_CLASS_PUBKEY
);
253 auth
->add(auth
, AUTH_RULE_IDENTITY
,
254 identification_create_from_encoding(ID_KEY_ID
, me
));
255 this->current
->add_auth_cfg(this->current
, auth
, TRUE
);
256 auth
= auth_cfg_create();
257 auth
->add(auth
, AUTH_RULE_AUTH_CLASS
, AUTH_CLASS_PUBKEY
);
258 auth
->add(auth
, AUTH_RULE_IDENTITY
,
259 identification_create_from_encoding(ID_KEY_ID
, other
));
260 this->current
->add_auth_cfg(this->current
, auth
, FALSE
);
262 child_cfg
= child_cfg_create(name
, &lifetime
, NULL
, TRUE
, MODE_TUNNEL
,
263 ACTION_NONE
, ACTION_NONE
, FALSE
, 0, 0, NULL
);
264 child_cfg
->add_proposal(child_cfg
, proposal_create_default(PROTO_ESP
));
265 child_cfg
->add_traffic_selector(child_cfg
, TRUE
, ts_from_string(local_net
));
266 child_cfg
->add_traffic_selector(child_cfg
, FALSE
, ts_from_string(remote_net
));
267 this->current
->add_child_cfg(this->current
, child_cfg
);
268 *cfg
= this->current
;
273 * Implementation of peer_enumerator_t.public.destroy
275 static void peer_enumerator_destroy(peer_enumerator_t
*this)
277 DESTROY_IF(this->current
);
278 this->inner
->destroy(this->inner
);
283 * Implementation of backend_t.create_peer_cfg_enumerator.
285 static enumerator_t
* create_peer_cfg_enumerator(private_medcli_config_t
*this,
286 identification_t
*me
,
287 identification_t
*other
)
289 peer_enumerator_t
*e
= malloc_thing(peer_enumerator_t
);
293 e
->rekey
= this->rekey
;
295 e
->public.enumerate
= (void*)peer_enumerator_enumerate
;
296 e
->public.destroy
= (void*)peer_enumerator_destroy
;
298 /* filter on IDs: NULL or ANY or matching KEY_ID */
299 e
->inner
= this->db
->query(this->db
,
300 "SELECT Alias, ClientConfig.KeyId, Connection.KeyId, "
301 "Connection.LocalSubnet, Connection.RemoteSubnet "
302 "FROM ClientConfig JOIN Connection "
304 "(? OR ClientConfig.KeyId = ?) AND (? OR Connection.KeyId = ?)",
305 DB_INT
, me
== NULL
|| me
->get_type(me
) == ID_ANY
,
306 DB_BLOB
, me
&& me
->get_type(me
) == ID_KEY_ID
?
307 me
->get_encoding(me
) : chunk_empty
,
308 DB_INT
, other
== NULL
|| other
->get_type(other
) == ID_ANY
,
309 DB_BLOB
, other
&& other
->get_type(other
) == ID_KEY_ID
?
310 other
->get_encoding(other
) : chunk_empty
,
311 DB_TEXT
, DB_BLOB
, DB_BLOB
, DB_TEXT
, DB_TEXT
);
321 * initiate a peer config
323 static job_requeue_t
initiate_config(peer_cfg_t
*peer_cfg
)
325 enumerator_t
*enumerator
;
326 child_cfg_t
*child_cfg
= NULL
;;
328 enumerator
= peer_cfg
->create_child_cfg_enumerator(peer_cfg
);
329 enumerator
->enumerate(enumerator
, &child_cfg
);
332 child_cfg
->get_ref(child_cfg
);
333 peer_cfg
->get_ref(peer_cfg
);
334 enumerator
->destroy(enumerator
);
335 charon
->controller
->initiate(charon
->controller
,
336 peer_cfg
, child_cfg
, NULL
, NULL
);
340 enumerator
->destroy(enumerator
);
342 return JOB_REQUEUE_NONE
;
346 * schedule initation of all "active" connections
348 static void schedule_autoinit(private_medcli_config_t
*this)
353 e
= this->db
->query(this->db
, "SELECT Alias FROM Connection WHERE Active",
357 while (e
->enumerate(e
, &name
))
359 peer_cfg_t
*peer_cfg
;
361 peer_cfg
= get_peer_cfg_by_name(this, name
);
364 /* schedule asynchronous initiation job */
365 charon
->processor
->queue_job(charon
->processor
,
366 (job_t
*)callback_job_create(
367 (callback_job_cb_t
)initiate_config
,
368 peer_cfg
, (void*)peer_cfg
->destroy
, NULL
));
376 * Implementation of medcli_config_t.destroy.
378 static void destroy(private_medcli_config_t
*this)
380 this->ike
->destroy(this->ike
);
385 * Described in header.
387 medcli_config_t
*medcli_config_create(database_t
*db
)
389 private_medcli_config_t
*this = malloc_thing(private_medcli_config_t
);
391 this->public.backend
.create_peer_cfg_enumerator
= (enumerator_t
*(*)(backend_t
*, identification_t
*me
, identification_t
*other
))create_peer_cfg_enumerator
;
392 this->public.backend
.create_ike_cfg_enumerator
= (enumerator_t
*(*)(backend_t
*, host_t
*me
, host_t
*other
))create_ike_cfg_enumerator
;
393 this->public.backend
.get_peer_cfg_by_name
= (peer_cfg_t
* (*)(backend_t
*,char*))get_peer_cfg_by_name
;
394 this->public.destroy
= (void(*)(medcli_config_t
*))destroy
;
397 this->rekey
= lib
->settings
->get_time(lib
->settings
, "medcli.rekey", 1200);
398 this->dpd
= lib
->settings
->get_time(lib
->settings
, "medcli.dpd", 300);
399 this->ike
= ike_cfg_create(FALSE
, FALSE
,
400 "0.0.0.0", IKEV2_UDP_PORT
, "0.0.0.0", IKEV2_UDP_PORT
);
401 this->ike
->add_proposal(this->ike
, proposal_create_default(PROTO_IKE
));
403 schedule_autoinit(this);
405 return &this->public;