src/libcharon/plugins/stroke/stroke_config.c

   1 /*
   2  * Copyright (C) 2012-2014 Tobias Brunner
   3  * Copyright (C) 2008 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include "stroke_config.h"
  18
  19 #include <daemon.h>
  20 #include <threading/mutex.h>
  21 #include <utils/lexparser.h>
  22
  23 #include <netdb.h>
  24
  25 typedef struct private_stroke_config_t private_stroke_config_t;
  26
  27 /**
  28  * private data of stroke_config
  29  */
  30 struct private_stroke_config_t {
  31
  32         /**
  33          * public functions
  34          */
  35         stroke_config_t public;
  36
  37         /**
  38          * list of peer_cfg_t
  39          */
  40         linked_list_t *list;
  41
  42         /**
  43          * mutex to lock config list
  44          */
  45         mutex_t *mutex;
  46
  47         /**
  48          * ca sections
  49          */
  50         stroke_ca_t *ca;
  51
  52         /**
  53          * credentials
  54          */
  55         stroke_cred_t *cred;
  56
  57         /**
  58          * Virtual IP pool / DNS backend
  59          */
  60         stroke_attribute_t *attributes;
  61 };
  62
  63 METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*,
  64         private_stroke_config_t *this, identification_t *me, identification_t *other)
  65 {
  66         this->mutex->lock(this->mutex);
  67         return enumerator_create_cleaner(this->list->create_enumerator(this->list),
  68                                                                          (void*)this->mutex->unlock, this->mutex);
  69 }
  70
  71 /**
  72  * filter function for ike configs
  73  */
  74 static bool ike_filter(void *data, peer_cfg_t **in, ike_cfg_t **out)
  75 {
  76         *out = (*in)->get_ike_cfg(*in);
  77         return TRUE;
  78 }
  79
  80 METHOD(backend_t, create_ike_cfg_enumerator, enumerator_t*,
  81         private_stroke_config_t *this, host_t *me, host_t *other)
  82 {
  83         this->mutex->lock(this->mutex);
  84         return enumerator_create_filter(this->list->create_enumerator(this->list),
  85                                                                         (void*)ike_filter, this->mutex,
  86                                                                         (void*)this->mutex->unlock);
  87 }
  88
  89 METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
  90         private_stroke_config_t *this, char *name)
  91 {
  92         enumerator_t *e1, *e2;
  93         peer_cfg_t *current, *found = NULL;
  94         child_cfg_t *child;
  95
  96         this->mutex->lock(this->mutex);
  97         e1 = this->list->create_enumerator(this->list);
  98         while (e1->enumerate(e1, &current))
  99         {
 100                 /* compare peer_cfgs name first */
 101                 if (streq(current->get_name(current), name))
 102                 {
 103                         found = current;
 104                         found->get_ref(found);
 105                         break;
 106                 }
 107                 /* compare all child_cfg names otherwise */
 108                 e2 = current->create_child_cfg_enumerator(current);
 109                 while (e2->enumerate(e2, &child))
 110                 {
 111                         if (streq(child->get_name(child), name))
 112                         {
 113                                 found = current;
 114                                 found->get_ref(found);
 115                                 break;
 116                         }
 117                 }
 118                 e2->destroy(e2);
 119                 if (found)
 120                 {
 121                         break;
 122                 }
 123         }
 124         e1->destroy(e1);
 125         this->mutex->unlock(this->mutex);
 126         return found;
 127 }
 128
 129 /**
 130  * parse a proposal string, either into ike_cfg or child_cfg
 131  */
 132 static void add_proposals(private_stroke_config_t *this, char *string,
 133                                 ike_cfg_t *ike_cfg, child_cfg_t *child_cfg, protocol_id_t proto)
 134 {
 135         if (string)
 136         {
 137                 char *single;
 138                 char *strict;
 139                 proposal_t *proposal;
 140
 141                 strict = string + strlen(string) - 1;
 142                 if (*strict == '!')
 143                 {
 144                         *strict = '\0';
 145                 }
 146                 else
 147                 {
 148                         strict = NULL;
 149                 }
 150                 while ((single = strsep(&string, ",")))
 151                 {
 152                         proposal = proposal_create_from_string(proto, single);
 153                         if (proposal)
 154                         {
 155                                 if (ike_cfg)
 156                                 {
 157                                         ike_cfg->add_proposal(ike_cfg, proposal);
 158                                 }
 159                                 else
 160                                 {
 161                                         child_cfg->add_proposal(child_cfg, proposal);
 162                                 }
 163                                 continue;
 164                         }
 165                         DBG1(DBG_CFG, "skipped invalid proposal string: %s", single);
 166                 }
 167                 if (strict)
 168                 {
 169                         return;
 170                 }
 171                 /* add default porposal to the end if not strict */
 172         }
 173         if (ike_cfg)
 174         {
 175                 ike_cfg->add_proposal(ike_cfg, proposal_create_default(proto));
 176                 ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(proto));
 177         }
 178         else
 179         {
 180                 child_cfg->add_proposal(child_cfg, proposal_create_default(proto));
 181                 child_cfg->add_proposal(child_cfg, proposal_create_default_aead(proto));
 182         }
 183 }
 184
 185 /**
 186  * Check if any addresses in the given string are local
 187  */
 188 static bool is_local(char *address, bool any_allowed)
 189 {
 190         enumerator_t *enumerator;
 191         host_t *host;
 192         char *token;
 193         bool found = FALSE;
 194
 195         enumerator = enumerator_create_token(address, ",", " ");
 196         while (enumerator->enumerate(enumerator, &token))
 197         {
 198                 if (!strchr(token, '/'))
 199                 {
 200                         host = host_create_from_dns(token, 0, 0);
 201                         if (host)
 202                         {
 203                                 if (charon->kernel->get_interface(charon->kernel, host, NULL))
 204                                 {
 205                                         found = TRUE;
 206                                 }
 207                                 else if (any_allowed && host->is_anyaddr(host))
 208                                 {
 209                                         found = TRUE;
 210                                 }
 211                                 host->destroy(host);
 212                                 if (found)
 213                                 {
 214                                         break;
 215                                 }
 216                         }
 217                 }
 218         }
 219         enumerator->destroy(enumerator);
 220         return found;
 221 }
 222
 223 /**
 224  * Swap ends if indicated by left|right
 225  */
 226 static void swap_ends(stroke_msg_t *msg)
 227 {
 228         if (!lib->settings->get_bool(lib->settings, "%s.plugins.stroke.allow_swap",
 229                                                                  TRUE, lib->ns))
 230         {
 231                 return;
 232         }
 233
 234         if (is_local(msg->add_conn.other.address, FALSE))
 235         {
 236                 stroke_end_t tmp_end;
 237
 238                 DBG2(DBG_CFG, "left is other host, swapping ends");
 239                 tmp_end = msg->add_conn.me;
 240                 msg->add_conn.me = msg->add_conn.other;
 241                 msg->add_conn.other = tmp_end;
 242         }
 243         else if (!is_local(msg->add_conn.me.address, TRUE))
 244         {
 245                 DBG1(DBG_CFG, "left nor right host is our side, assuming left=local");
 246         }
 247 }
 248
 249 /**
 250  * Build an IKE config from a stroke message
 251  */
 252 static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg)
 253 {
 254         ike_cfg_t *ike_cfg;
 255         u_int16_t ikeport;
 256         char me[256], other[256];
 257
 258         swap_ends(msg);
 259
 260         if (msg->add_conn.me.allow_any)
 261         {
 262                 snprintf(me, sizeof(me), "%s,0.0.0.0/0,::/0",
 263                                  msg->add_conn.me.address);
 264         }
 265         if (msg->add_conn.other.allow_any)
 266         {
 267                 snprintf(other, sizeof(other), "%s,0.0.0.0/0,::/0",
 268                                  msg->add_conn.other.address);
 269         }
 270         ikeport = msg->add_conn.me.ikeport;
 271         ikeport = (ikeport == IKEV2_UDP_PORT) ?
 272                            charon->socket->get_port(charon->socket, FALSE) : ikeport;
 273         ike_cfg = ike_cfg_create(msg->add_conn.version,
 274                                                          msg->add_conn.other.sendcert != CERT_NEVER_SEND,
 275                                                          msg->add_conn.force_encap,
 276                                                          msg->add_conn.me.allow_any ?
 277                                                                 me : msg->add_conn.me.address,
 278                                                          ikeport,
 279                                                          msg->add_conn.other.allow_any ?
 280                                                                 other : msg->add_conn.other.address,
 281                                                          msg->add_conn.other.ikeport,
 282                                                          msg->add_conn.fragmentation,
 283                                                          msg->add_conn.ikedscp);
 284
 285         add_proposals(this, msg->add_conn.algorithms.ike, ike_cfg, NULL, PROTO_IKE);
 286         return ike_cfg;
 287 }
 288
 289 /**
 290  * Add CRL constraint to config
 291  */
 292 static void build_crl_policy(auth_cfg_t *cfg, bool local, int policy)
 293 {
 294         /* CRL/OCSP policy, for remote config only */
 295         if (!local)
 296         {
 297                 switch (policy)
 298                 {
 299                         case CRL_STRICT_YES:
 300                                 /* if yes, we require a GOOD validation */
 301                                 cfg->add(cfg, AUTH_RULE_CRL_VALIDATION, VALIDATION_GOOD);
 302                                 break;
 303                         case CRL_STRICT_IFURI:
 304                                 /* for ifuri, a SKIPPED validation is sufficient */
 305                                 cfg->add(cfg, AUTH_RULE_CRL_VALIDATION, VALIDATION_SKIPPED);
 306                                 break;
 307                         default:
 308                                 break;
 309                 }
 310         }
 311 }
 312
 313 /**
 314  * build authentication config
 315  */
 316 static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 317                                                                   stroke_msg_t *msg, bool local, bool primary)
 318 {
 319         identification_t *identity;
 320         certificate_t *certificate;
 321         char *auth, *id, *pubkey, *cert, *ca, *groups;
 322         stroke_end_t *end, *other_end;
 323         auth_cfg_t *cfg;
 324         bool loose = FALSE;
 325
 326         /* select strings */
 327         if (local)
 328         {
 329                 end = &msg->add_conn.me;
 330                 other_end = &msg->add_conn.other;
 331         }
 332         else
 333         {
 334                 end = &msg->add_conn.other;
 335                 other_end = &msg->add_conn.me;
 336         }
 337         if (primary)
 338         {
 339                 auth = end->auth;
 340                 id = end->id;
 341                 if (!id)
 342                 {       /* leftid/rightid fallback to address */
 343                         id = end->address;
 344                 }
 345                 cert = end->cert;
 346                 ca = end->ca;
 347                 if (ca && streq(ca, "%same"))
 348                 {
 349                         ca = other_end->ca;
 350                 }
 351         }
 352         else
 353         {
 354                 auth = end->auth2;
 355                 id = end->id2;
 356                 if (local && !id)
 357                 {       /* leftid2 falls back to leftid */
 358                         id = end->id;
 359                 }
 360                 cert = end->cert2;
 361                 ca = end->ca2;
 362                 if (ca && streq(ca, "%same"))
 363                 {
 364                         ca = other_end->ca2;
 365                 }
 366         }
 367         if (id && *id == '%' && !streq(id, "%any") && !streq(id, "%any6"))
 368         {       /* has only an effect on rightid/2 */
 369                 loose = !local;
 370                 id++;
 371         }
 372
 373         if (!auth)
 374         {
 375                 if (primary)
 376                 {
 377                         auth = "pubkey";
 378                 }
 379                 else
 380                 {       /* no second authentication round, fine. But load certificates
 381                          * for other purposes (EAP-TLS) */
 382                         if (cert)
 383                         {
 384                                 certificate = this->cred->load_peer(this->cred, cert);
 385                                 if (certificate)
 386                                 {
 387                                         certificate->destroy(certificate);
 388                                 }
 389                         }
 390                         return NULL;
 391                 }
 392         }
 393
 394         cfg = auth_cfg_create();
 395
 396         /* add identity and peer certificate */
 397         identity = identification_create_from_string(id);
 398         if (cert)
 399         {
 400                 enumerator_t *enumerator;
 401                 bool has_subject = FALSE;
 402                 certificate_t *first = NULL;
 403
 404                 enumerator = enumerator_create_token(cert, ",", " ");
 405                 while (enumerator->enumerate(enumerator, &cert))
 406                 {
 407                         certificate = this->cred->load_peer(this->cred, cert);
 408                         if (certificate)
 409                         {
 410                                 if (local)
 411                                 {
 412                                         this->ca->check_for_hash_and_url(this->ca, certificate);
 413                                 }
 414                                 cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
 415                                 if (!first)
 416                                 {
 417                                         first = certificate;
 418                                 }
 419                                 if (identity->get_type(identity) != ID_ANY &&
 420                                         certificate->has_subject(certificate, identity))
 421                                 {
 422                                         has_subject = TRUE;
 423                                 }
 424                         }
 425                 }
 426                 enumerator->destroy(enumerator);
 427
 428                 if (first && !has_subject)
 429                 {
 430                         DBG1(DBG_CFG, "  id '%Y' not confirmed by certificate, "
 431                                  "defaulting to '%Y'", identity, first->get_subject(first));
 432                         identity->destroy(identity);
 433                         identity = first->get_subject(first);
 434                         identity = identity->clone(identity);
 435                 }
 436         }
 437         /* add raw RSA public key */
 438         pubkey = end->rsakey;
 439         if (pubkey && !streq(pubkey, "") && !streq(pubkey, "%cert"))
 440         {
 441                 certificate = this->cred->load_pubkey(this->cred, pubkey, identity);
 442                 if (certificate)
 443                 {
 444                         cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
 445                 }
 446         }
 447         if (identity->get_type(identity) != ID_ANY)
 448         {
 449                 cfg->add(cfg, AUTH_RULE_IDENTITY, identity);
 450                 if (loose)
 451                 {
 452                         cfg->add(cfg, AUTH_RULE_IDENTITY_LOOSE, TRUE);
 453                 }
 454         }
 455         else
 456         {
 457                 identity->destroy(identity);
 458         }
 459
 460         /* CA constraint */
 461         if (ca)
 462         {
 463                 identity = identification_create_from_string(ca);
 464                 certificate = lib->credmgr->get_cert(lib->credmgr, CERT_X509,
 465                                                                                          KEY_ANY, identity, TRUE);
 466                 identity->destroy(identity);
 467                 if (certificate)
 468                 {
 469                         cfg->add(cfg, AUTH_RULE_CA_CERT, certificate);
 470                 }
 471                 else
 472                 {
 473                         DBG1(DBG_CFG, "CA certificate \"%s\" not found, discarding CA "
 474                                  "constraint", ca);
 475                 }
 476         }
 477
 478         /* groups */
 479         groups = primary ? end->groups : end->groups2;
 480         if (groups)
 481         {
 482                 enumerator_t *enumerator;
 483                 char *group;
 484
 485                 enumerator = enumerator_create_token(groups, ",", " ");
 486                 while (enumerator->enumerate(enumerator, &group))
 487                 {
 488                         cfg->add(cfg, AUTH_RULE_GROUP,
 489                                          identification_create_from_string(group));
 490                 }
 491                 enumerator->destroy(enumerator);
 492         }
 493
 494         /* certificatePolicies */
 495         if (end->cert_policy)
 496         {
 497                 enumerator_t *enumerator;
 498                 char *policy;
 499
 500                 enumerator = enumerator_create_token(end->cert_policy, ",", " ");
 501                 while (enumerator->enumerate(enumerator, &policy))
 502                 {
 503                         cfg->add(cfg, AUTH_RULE_CERT_POLICY, strdup(policy));
 504                 }
 505                 enumerator->destroy(enumerator);
 506         }
 507
 508         /* authentication metod (class, actually) */
 509         if (strpfx(auth, "pubkey") ||
 510                 strpfx(auth, "rsa") ||
 511                 strpfx(auth, "ecdsa") ||
 512                 strpfx(auth, "bliss"))
 513         {
 514                 cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 515                 build_crl_policy(cfg, local, msg->add_conn.crl_policy);
 516                 cfg->add_pubkey_constraints(cfg, auth);
 517         }
 518         else if (streq(auth, "psk") || streq(auth, "secret"))
 519         {
 520                 cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
 521         }
 522         else if (strpfx(auth, "xauth"))
 523         {
 524                 char *pos;
 525
 526                 pos = strchr(auth, '-');
 527                 if (pos)
 528                 {
 529                         cfg->add(cfg, AUTH_RULE_XAUTH_BACKEND, strdup(++pos));
 530                 }
 531                 cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_XAUTH);
 532                 if (msg->add_conn.xauth_identity)
 533                 {
 534                         cfg->add(cfg, AUTH_RULE_XAUTH_IDENTITY,
 535                                 identification_create_from_string(msg->add_conn.xauth_identity));
 536                 }
 537         }
 538         else if (strpfx(auth, "eap"))
 539         {
 540                 eap_vendor_type_t *type;
 541                 char *pos;
 542
 543                 cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
 544                 /* check for public key constraints for EAP-TLS etc. */
 545                 pos = strchr(auth, ':');
 546                 if (pos)
 547                 {
 548                         *pos = 0;
 549                         cfg->add_pubkey_constraints(cfg, pos + 1);
 550                 }
 551                 type = eap_vendor_type_from_string(auth);
 552                 if (type)
 553                 {
 554                         cfg->add(cfg, AUTH_RULE_EAP_TYPE, type->type);
 555                         if (type->vendor)
 556                         {
 557                                 cfg->add(cfg, AUTH_RULE_EAP_VENDOR, type->vendor);
 558                         }
 559                         free(type);
 560                 }
 561
 562                 if (msg->add_conn.eap_identity)
 563                 {
 564                         if (streq(msg->add_conn.eap_identity, "%identity"))
 565                         {
 566                                 identity = identification_create_from_encoding(ID_ANY,
 567                                                                                                                            chunk_empty);
 568                         }
 569                         else
 570                         {
 571                                 identity = identification_create_from_string(
 572                                                                                                         msg->add_conn.eap_identity);
 573                         }
 574                         cfg->add(cfg, AUTH_RULE_EAP_IDENTITY, identity);
 575                 }
 576                 if (msg->add_conn.aaa_identity)
 577                 {
 578                         cfg->add(cfg, AUTH_RULE_AAA_IDENTITY,
 579                                 identification_create_from_string(msg->add_conn.aaa_identity));
 580                 }
 581         }
 582         else
 583         {
 584                 if (!streq(auth, "any"))
 585                 {
 586                         DBG1(DBG_CFG, "authentication method %s unknown, fallback to any",
 587                                  auth);
 588                 }
 589                 build_crl_policy(cfg, local, msg->add_conn.crl_policy);
 590         }
 591         return cfg;
 592 }
 593
 594 /**
 595  * build a mem_pool_t from an address range
 596  */
 597 static mem_pool_t *create_pool_range(char *str)
 598 {
 599         mem_pool_t *pool;
 600         host_t *from, *to;
 601
 602         if (!host_create_from_range(str, &from, &to))
 603         {
 604                 return NULL;
 605         }
 606         pool = mem_pool_create_range(str, from, to);
 607         from->destroy(from);
 608         to->destroy(to);
 609         return pool;
 610 }
 611
 612 /**
 613  * build a peer_cfg from a stroke msg
 614  */
 615 static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 616                                                                   stroke_msg_t *msg, ike_cfg_t *ike_cfg)
 617 {
 618         identification_t *peer_id = NULL;
 619         peer_cfg_t *mediated_by = NULL;
 620         unique_policy_t unique;
 621         u_int32_t rekey = 0, reauth = 0, over, jitter;
 622         peer_cfg_t *peer_cfg;
 623         auth_cfg_t *auth_cfg;
 624
 625 #ifdef ME
 626         if (msg->add_conn.ikeme.mediation && msg->add_conn.ikeme.mediated_by)
 627         {
 628                 DBG1(DBG_CFG, "a mediation connection cannot be a mediated connection "
 629                          "at the same time, aborting");
 630                 return NULL;
 631         }
 632
 633         if (msg->add_conn.ikeme.mediation)
 634         {
 635                 /* force unique connections for mediation connections */
 636                 msg->add_conn.unique = 1;
 637         }
 638
 639         if (msg->add_conn.ikeme.mediated_by)
 640         {
 641                 mediated_by = charon->backends->get_peer_cfg_by_name(charon->backends,
 642                                                                                         msg->add_conn.ikeme.mediated_by);
 643                 if (!mediated_by)
 644                 {
 645                         DBG1(DBG_CFG, "mediation connection '%s' not found, aborting",
 646                                  msg->add_conn.ikeme.mediated_by);
 647                         return NULL;
 648                 }
 649                 if (!mediated_by->is_mediation(mediated_by))
 650                 {
 651                         DBG1(DBG_CFG, "connection '%s' as referred to by '%s' is "
 652                                  "no mediation connection, aborting",
 653                                  msg->add_conn.ikeme.mediated_by, msg->add_conn.name);
 654                         mediated_by->destroy(mediated_by);
 655                         return NULL;
 656                 }
 657                 if (msg->add_conn.ikeme.peerid)
 658                 {
 659                         peer_id = identification_create_from_string(msg->add_conn.ikeme.peerid);
 660                 }
 661                 else if (msg->add_conn.other.id)
 662                 {
 663                         peer_id = identification_create_from_string(msg->add_conn.other.id);
 664                 }
 665         }
 666 #endif /* ME */
 667
 668         jitter = msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100;
 669         over = msg->add_conn.rekey.margin;
 670         if (msg->add_conn.rekey.reauth)
 671         {
 672                 reauth = msg->add_conn.rekey.ike_lifetime - over;
 673         }
 674         else
 675         {
 676                 rekey = msg->add_conn.rekey.ike_lifetime - over;
 677         }
 678         switch (msg->add_conn.unique)
 679         {
 680                 case 1: /* yes */
 681                 case 2: /* replace */
 682                         unique = UNIQUE_REPLACE;
 683                         break;
 684                 case 3: /* keep */
 685                         unique = UNIQUE_KEEP;
 686                         break;
 687                 case 4: /* never */
 688                         unique = UNIQUE_NEVER;
 689                         break;
 690                 default: /* no */
 691                         unique = UNIQUE_NO;
 692                         break;
 693         }
 694         if (msg->add_conn.dpd.action == 0)
 695         {       /* dpdaction=none disables DPD */
 696                 msg->add_conn.dpd.delay = 0;
 697         }
 698
 699         /* other.sourceip is managed in stroke_attributes. If it is set, we define
 700          * the pool name as the connection name, which the attribute provider
 701          * uses to serve pool addresses. */
 702         peer_cfg = peer_cfg_create(msg->add_conn.name, ike_cfg,
 703                 msg->add_conn.me.sendcert, unique,
 704                 msg->add_conn.rekey.tries, rekey, reauth, jitter, over,
 705                 msg->add_conn.mobike, msg->add_conn.aggressive,
 706                 msg->add_conn.pushmode == 0,
 707                 msg->add_conn.dpd.delay, msg->add_conn.dpd.timeout,
 708                 msg->add_conn.ikeme.mediation, mediated_by, peer_id);
 709
 710         if (msg->add_conn.other.sourceip)
 711         {
 712                 enumerator_t *enumerator;
 713                 char *token;
 714
 715                 enumerator = enumerator_create_token(msg->add_conn.other.sourceip,
 716                                                                                          ",", " ");
 717                 while (enumerator->enumerate(enumerator, &token))
 718                 {
 719                         if (streq(token, "%modeconfig") || streq(token, "%modecfg") ||
 720                                 streq(token, "%config") || streq(token, "%cfg") ||
 721                                 streq(token, "%config4") || streq(token, "%config6"))
 722                         {
 723                                 /* empty pool, uses connection name */
 724                                 this->attributes->add_pool(this->attributes,
 725                                                                 mem_pool_create(msg->add_conn.name, NULL, 0));
 726                                 peer_cfg->add_pool(peer_cfg, msg->add_conn.name);
 727                         }
 728                         else if (*token == '%')
 729                         {
 730                                 /* external named pool */
 731                                 peer_cfg->add_pool(peer_cfg, token + 1);
 732                         }
 733                         else
 734                         {
 735                                 /* in-memory pool, using range or CIDR notation */
 736                                 mem_pool_t *pool;
 737                                 host_t *base;
 738                                 int bits;
 739
 740                                 pool = create_pool_range(token);
 741                                 if (!pool)
 742                                 {
 743                                         base = host_create_from_subnet(token, &bits);
 744                                         if (base)
 745                                         {
 746                                                 pool = mem_pool_create(token, base, bits);
 747                                                 base->destroy(base);
 748                                         }
 749                                 }
 750                                 if (pool)
 751                                 {
 752                                         this->attributes->add_pool(this->attributes, pool);
 753                                         peer_cfg->add_pool(peer_cfg, token);
 754                                 }
 755                                 else
 756                                 {
 757                                         DBG1(DBG_CFG, "IP pool %s invalid, ignored", token);
 758                                 }
 759                         }
 760                 }
 761                 enumerator->destroy(enumerator);
 762         }
 763
 764         if (msg->add_conn.me.sourceip && msg->add_conn.other.sourceip)
 765         {
 766                 DBG1(DBG_CFG, "'%s' has both left- and rightsourceip, but IKE can "
 767                          "negotiate one virtual IP only, ignoring local virtual IP",
 768                          msg->add_conn.name);
 769         }
 770         else if (msg->add_conn.me.sourceip)
 771         {
 772                 enumerator_t *enumerator;
 773                 char *token;
 774
 775                 enumerator = enumerator_create_token(msg->add_conn.me.sourceip, ",", " ");
 776                 while (enumerator->enumerate(enumerator, &token))
 777                 {
 778                         host_t *vip = NULL;
 779
 780                         if (streq(token, "%modeconfig") || streq(token, "%modecfg") ||
 781                                 streq(token, "%config") || streq(token, "%cfg"))
 782                         {       /* try to deduce an address family */
 783                                 if (msg->add_conn.me.subnets)
 784                                 {       /* use the same family as in local subnet, if any */
 785                                         if (strchr(msg->add_conn.me.subnets, '.'))
 786                                         {
 787                                                 vip = host_create_any(AF_INET);
 788                                         }
 789                                         else
 790                                         {
 791                                                 vip = host_create_any(AF_INET6);
 792                                         }
 793                                 }
 794                                 else if (msg->add_conn.other.subnets)
 795                                 {       /* use the same family as in remote subnet, if any */
 796                                         if (strchr(msg->add_conn.other.subnets, '.'))
 797                                         {
 798                                                 vip = host_create_any(AF_INET);
 799                                         }
 800                                         else
 801                                         {
 802                                                 vip = host_create_any(AF_INET6);
 803                                         }
 804                                 }
 805                                 else
 806                                 {
 807                                         char *addr, *next, *hit;
 808
 809                                         /* guess virtual IP family based on local address. If
 810                                          * multiple addresses are specified, we look at the first
 811                                          * only, as with leftallowany a ::/0 is always appended. */
 812                                         addr = ike_cfg->get_my_addr(ike_cfg);
 813                                         next = strchr(addr, ',');
 814                                         hit = strchr(addr, ':');
 815                                         if (hit && (!next || hit < next))
 816                                         {
 817                                                 vip = host_create_any(AF_INET6);
 818                                         }
 819                                         else
 820                                         {
 821                                                 vip = host_create_any(AF_INET);
 822                                         }
 823                                 }
 824                         }
 825                         else if (streq(token, "%config4"))
 826                         {
 827                                 vip = host_create_any(AF_INET);
 828                         }
 829                         else if (streq(token, "%config6"))
 830                         {
 831                                 vip = host_create_any(AF_INET6);
 832                         }
 833                         else
 834                         {
 835                                 vip = host_create_from_string(token, 0);
 836                                 if (!vip)
 837                                 {
 838                                         DBG1(DBG_CFG, "ignored invalid subnet token: %s", token);
 839                                 }
 840                         }
 841
 842                         if (vip)
 843                         {
 844                                 peer_cfg->add_virtual_ip(peer_cfg, vip);
 845                         }
 846                 }
 847                 enumerator->destroy(enumerator);
 848         }
 849
 850         /* build leftauth= */
 851         auth_cfg = build_auth_cfg(this, msg, TRUE, TRUE);
 852         if (auth_cfg)
 853         {
 854                 peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, TRUE);
 855         }
 856         else
 857         {       /* we require at least one config on our side */
 858                 peer_cfg->destroy(peer_cfg);
 859                 return NULL;
 860         }
 861         /* build leftauth2= */
 862         auth_cfg = build_auth_cfg(this, msg, TRUE, FALSE);
 863         if (auth_cfg)
 864         {
 865                 peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, TRUE);
 866         }
 867         /* build rightauth= */
 868         auth_cfg = build_auth_cfg(this, msg, FALSE, TRUE);
 869         if (auth_cfg)
 870         {
 871                 peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, FALSE);
 872         }
 873         /* build rightauth2= */
 874         auth_cfg = build_auth_cfg(this, msg, FALSE, FALSE);
 875         if (auth_cfg)
 876         {
 877                 peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, FALSE);
 878         }
 879         return peer_cfg;
 880 }
 881
 882 /**
 883  * Parse a protoport specifier
 884  */
 885 static bool parse_protoport(char *token, u_int16_t *from_port,
 886                                                         u_int16_t *to_port, u_int8_t *protocol)
 887 {
 888         char *sep, *port = "", *endptr;
 889         struct protoent *proto;
 890         struct servent *svc;
 891         long int p;
 892
 893         sep = strrchr(token, ']');
 894         if (!sep)
 895         {
 896                 return FALSE;
 897         }
 898         *sep = '\0';
 899
 900         sep = strchr(token, '/');
 901         if (sep)
 902         {       /* protocol/port */
 903                 *sep = '\0';
 904                 port = sep + 1;
 905         }
 906
 907         if (streq(token, "%any"))
 908         {
 909                 *protocol = 0;
 910         }
 911         else
 912         {
 913                 proto = getprotobyname(token);
 914                 if (proto)
 915                 {
 916                         *protocol = proto->p_proto;
 917                 }
 918                 else
 919                 {
 920                         p = strtol(token, &endptr, 0);
 921                         if ((*token && *endptr) || p < 0 || p > 0xff)
 922                         {
 923                                 return FALSE;
 924                         }
 925                         *protocol = (u_int8_t)p;
 926                 }
 927         }
 928         if (streq(port, "%any"))
 929         {
 930                 *from_port = 0;
 931                 *to_port = 0xffff;
 932         }
 933         else if (streq(port, "%opaque"))
 934         {
 935                 *from_port = 0xffff;
 936                 *to_port = 0;
 937         }
 938         else if (*port)
 939         {
 940                 svc = getservbyname(port, NULL);
 941                 if (svc)
 942                 {
 943                         *from_port = *to_port = ntohs(svc->s_port);
 944                 }
 945                 else
 946                 {
 947                         p = strtol(port, &endptr, 0);
 948                         if (p < 0 || p > 0xffff)
 949                         {
 950                                 return FALSE;
 951                         }
 952                         *from_port = p;
 953                         if (*endptr == '-')
 954                         {
 955                                 port = endptr + 1;
 956                                 p = strtol(port, &endptr, 0);
 957                                 if (p < 0 || p > 0xffff)
 958                                 {
 959                                         return FALSE;
 960                                 }
 961                         }
 962                         *to_port = p;
 963                         if (*endptr)
 964                         {
 965                                 return FALSE;
 966                         }
 967                 }
 968         }
 969         return TRUE;
 970 }
 971
 972 /**
 973  * build a traffic selector from a stroke_end
 974  */
 975 static void add_ts(private_stroke_config_t *this,
 976                                    stroke_end_t *end, child_cfg_t *child_cfg, bool local)
 977 {
 978         traffic_selector_t *ts;
 979
 980         if (end->tohost)
 981         {
 982                 ts = traffic_selector_create_dynamic(end->protocol,
 983                                                                                          end->from_port, end->to_port);
 984                 child_cfg->add_traffic_selector(child_cfg, local, ts);
 985         }
 986         else
 987         {
 988                 if (!end->subnets)
 989                 {
 990                         host_t *net;
 991
 992                         net = host_create_from_string(end->address, 0);
 993                         if (net)
 994                         {
 995                                 ts = traffic_selector_create_from_subnet(net, 0, end->protocol,
 996                                                                                                 end->from_port, end->to_port);
 997                                 child_cfg->add_traffic_selector(child_cfg, local, ts);
 998                         }
 999                 }
1000                 else
1001                 {
1002                         enumerator_t *enumerator;
1003                         char *subnet, *pos;
1004                         u_int16_t from_port, to_port;
1005                         u_int8_t proto;
1006
1007                         enumerator = enumerator_create_token(end->subnets, ",", " ");
1008                         while (enumerator->enumerate(enumerator, &subnet))
1009                         {
1010                                 from_port = end->from_port;
1011                                 to_port = end->to_port;
1012                                 proto = end->protocol;
1013
1014                                 pos = strchr(subnet, '[');
1015                                 if (pos)
1016                                 {
1017                                         *(pos++) = '\0';
1018                                         if (!parse_protoport(pos, &from_port, &to_port, &proto))
1019                                         {
1020                                                 DBG1(DBG_CFG, "invalid proto/port: %s, skipped subnet",
1021                                                          pos);
1022                                                 continue;
1023                                         }
1024                                 }
1025                                 if (streq(subnet, "%dynamic"))
1026                                 {
1027                                         ts = traffic_selector_create_dynamic(proto,
1028                                                                                                                  from_port, to_port);
1029                                 }
1030                                 else
1031                                 {
1032                                         ts = traffic_selector_create_from_cidr(subnet, proto,
1033                                                                                                                    from_port, to_port);
1034                                 }
1035                                 if (ts)
1036                                 {
1037                                         child_cfg->add_traffic_selector(child_cfg, local, ts);
1038                                 }
1039                                 else
1040                                 {
1041                                         DBG1(DBG_CFG, "invalid subnet: %s, skipped", subnet);
1042                                 }
1043                         }
1044                         enumerator->destroy(enumerator);
1045                 }
1046         }
1047 }
1048
1049 /**
1050  * map starter magic values to our action type
1051  */
1052 static action_t map_action(int starter_action)
1053 {
1054         switch (starter_action)
1055         {
1056                 case 2: /* =hold */
1057                         return ACTION_ROUTE;
1058                 case 3: /* =restart */
1059                         return ACTION_RESTART;
1060                 default:
1061                         return ACTION_NONE;
1062         }
1063 }
1064
1065 /**
1066  * build a child config from the stroke message
1067  */
1068 static child_cfg_t *build_child_cfg(private_stroke_config_t *this,
1069                                                                         stroke_msg_t *msg)
1070 {
1071         child_cfg_t *child_cfg;
1072         lifetime_cfg_t lifetime = {
1073                 .time = {
1074                         .life = msg->add_conn.rekey.ipsec_lifetime,
1075                         .rekey = msg->add_conn.rekey.ipsec_lifetime - msg->add_conn.rekey.margin,
1076                         .jitter = msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100
1077                 },
1078                 .bytes = {
1079                         .life = msg->add_conn.rekey.life_bytes,
1080                         .rekey = msg->add_conn.rekey.life_bytes - msg->add_conn.rekey.margin_bytes,
1081                         .jitter = msg->add_conn.rekey.margin_bytes * msg->add_conn.rekey.fuzz / 100
1082                 },
1083                 .packets = {
1084                         .life = msg->add_conn.rekey.life_packets,
1085                         .rekey = msg->add_conn.rekey.life_packets - msg->add_conn.rekey.margin_packets,
1086                         .jitter = msg->add_conn.rekey.margin_packets * msg->add_conn.rekey.fuzz / 100
1087                 }
1088         };
1089         mark_t mark_in = {
1090                 .value = msg->add_conn.mark_in.value,
1091                 .mask = msg->add_conn.mark_in.mask
1092         };
1093         mark_t mark_out = {
1094                 .value = msg->add_conn.mark_out.value,
1095                 .mask = msg->add_conn.mark_out.mask
1096         };
1097
1098         child_cfg = child_cfg_create(
1099                                 msg->add_conn.name, &lifetime, msg->add_conn.me.updown,
1100                                 msg->add_conn.me.hostaccess, msg->add_conn.mode, ACTION_NONE,
1101                                 map_action(msg->add_conn.dpd.action),
1102                                 map_action(msg->add_conn.close_action), msg->add_conn.ipcomp,
1103                                 msg->add_conn.inactivity, msg->add_conn.reqid,
1104                                 &mark_in, &mark_out, msg->add_conn.tfc);
1105         if (msg->add_conn.replay_window != -1)
1106         {
1107                 child_cfg->set_replay_window(child_cfg, msg->add_conn.replay_window);
1108         }
1109         child_cfg->set_mipv6_options(child_cfg, msg->add_conn.proxy_mode,
1110                                                                                         msg->add_conn.install_policy);
1111         add_ts(this, &msg->add_conn.me, child_cfg, TRUE);
1112         add_ts(this, &msg->add_conn.other, child_cfg, FALSE);
1113
1114         if (msg->add_conn.algorithms.ah)
1115         {
1116                 add_proposals(this, msg->add_conn.algorithms.ah,
1117                                           NULL, child_cfg, PROTO_AH);
1118         }
1119         else
1120         {
1121                 add_proposals(this, msg->add_conn.algorithms.esp,
1122                                           NULL, child_cfg, PROTO_ESP);
1123         }
1124         return child_cfg;
1125 }
1126
1127 METHOD(stroke_config_t, add, void,
1128         private_stroke_config_t *this, stroke_msg_t *msg)
1129 {
1130         ike_cfg_t *ike_cfg, *existing_ike;
1131         peer_cfg_t *peer_cfg, *existing;
1132         child_cfg_t *child_cfg;
1133         enumerator_t *enumerator;
1134         bool use_existing = FALSE;
1135
1136         ike_cfg = build_ike_cfg(this, msg);
1137         if (!ike_cfg)
1138         {
1139                 return;
1140         }
1141         peer_cfg = build_peer_cfg(this, msg, ike_cfg);
1142         if (!peer_cfg)
1143         {
1144                 ike_cfg->destroy(ike_cfg);
1145                 return;
1146         }
1147
1148         enumerator = create_peer_cfg_enumerator(this, NULL, NULL);
1149         while (enumerator->enumerate(enumerator, &existing))
1150         {
1151                 existing_ike = existing->get_ike_cfg(existing);
1152                 if (existing->equals(existing, peer_cfg) &&
1153                         existing_ike->equals(existing_ike, peer_cfg->get_ike_cfg(peer_cfg)))
1154                 {
1155                         use_existing = TRUE;
1156                         peer_cfg->destroy(peer_cfg);
1157                         peer_cfg = existing;
1158                         peer_cfg->get_ref(peer_cfg);
1159                         DBG1(DBG_CFG, "added child to existing configuration '%s'",
1160                                  peer_cfg->get_name(peer_cfg));
1161                         break;
1162                 }
1163         }
1164         enumerator->destroy(enumerator);
1165
1166         child_cfg = build_child_cfg(this, msg);
1167         if (!child_cfg)
1168         {
1169                 peer_cfg->destroy(peer_cfg);
1170                 return;
1171         }
1172         peer_cfg->add_child_cfg(peer_cfg, child_cfg);
1173
1174         if (use_existing)
1175         {
1176                 peer_cfg->destroy(peer_cfg);
1177         }
1178         else
1179         {
1180                 /* add config to backend */
1181                 DBG1(DBG_CFG, "added configuration '%s'", msg->add_conn.name);
1182                 this->mutex->lock(this->mutex);
1183                 this->list->insert_last(this->list, peer_cfg);
1184                 this->mutex->unlock(this->mutex);
1185         }
1186 }
1187
1188 METHOD(stroke_config_t, del, void,
1189         private_stroke_config_t *this, stroke_msg_t *msg)
1190 {
1191         enumerator_t *enumerator, *children;
1192         peer_cfg_t *peer;
1193         child_cfg_t *child;
1194         bool deleted = FALSE;
1195
1196         this->mutex->lock(this->mutex);
1197         enumerator = this->list->create_enumerator(this->list);
1198         while (enumerator->enumerate(enumerator, &peer))
1199         {
1200                 bool keep = FALSE;
1201
1202                 /* remove any child with such a name */
1203                 children = peer->create_child_cfg_enumerator(peer);
1204                 while (children->enumerate(children, &child))
1205                 {
1206                         if (streq(child->get_name(child), msg->del_conn.name))
1207                         {
1208                                 peer->remove_child_cfg(peer, children);
1209                                 child->destroy(child);
1210                                 deleted = TRUE;
1211                         }
1212                         else
1213                         {
1214                                 keep = TRUE;
1215                         }
1216                 }
1217                 children->destroy(children);
1218
1219                 /* if peer config has no children anymore, remove it */
1220                 if (!keep)
1221                 {
1222                         this->list->remove_at(this->list, enumerator);
1223                         peer->destroy(peer);
1224                 }
1225         }
1226         enumerator->destroy(enumerator);
1227         this->mutex->unlock(this->mutex);
1228
1229         if (deleted)
1230         {
1231                 DBG1(DBG_CFG, "deleted connection '%s'", msg->del_conn.name);
1232         }
1233         else
1234         {
1235                 DBG1(DBG_CFG, "connection '%s' not found", msg->del_conn.name);
1236         }
1237 }
1238
1239 METHOD(stroke_config_t, set_user_credentials, void,
1240         private_stroke_config_t *this, stroke_msg_t *msg, FILE *prompt)
1241 {
1242         enumerator_t *enumerator, *children, *remote_auth;
1243         peer_cfg_t *peer, *found = NULL;
1244         auth_cfg_t *auth_cfg, *remote_cfg;
1245         auth_class_t auth_class;
1246         child_cfg_t *child;
1247         identification_t *id, *identity, *gw = NULL;
1248         shared_key_type_t type = SHARED_ANY;
1249         chunk_t password = chunk_empty;
1250
1251         this->mutex->lock(this->mutex);
1252         enumerator = this->list->create_enumerator(this->list);
1253         while (enumerator->enumerate(enumerator, (void**)&peer))
1254         {       /* find the peer (or child) config with the given name */
1255                 if (streq(peer->get_name(peer), msg->user_creds.name))
1256                 {
1257                         found = peer;
1258                 }
1259                 else
1260                 {
1261                         children = peer->create_child_cfg_enumerator(peer);
1262                         while (children->enumerate(children, &child))
1263                         {
1264                                 if (streq(child->get_name(child), msg->user_creds.name))
1265                                 {
1266                                         found = peer;
1267                                         break;
1268                                 }
1269                         }
1270                         children->destroy(children);
1271                 }
1272
1273                 if (found)
1274                 {
1275                         break;
1276                 }
1277         }
1278         enumerator->destroy(enumerator);
1279
1280         if (!found)
1281         {
1282                 DBG1(DBG_CFG, "  no config named '%s'", msg->user_creds.name);
1283                 fprintf(prompt, "no config named '%s'\n", msg->user_creds.name);
1284                 this->mutex->unlock(this->mutex);
1285                 return;
1286         }
1287
1288         id = identification_create_from_string(msg->user_creds.username);
1289         if (strlen(msg->user_creds.username) == 0 ||
1290                 !id || id->get_type(id) == ID_ANY)
1291         {
1292                 DBG1(DBG_CFG, "  invalid username '%s'", msg->user_creds.username);
1293                 fprintf(prompt, "invalid username '%s'\n", msg->user_creds.username);
1294                 this->mutex->unlock(this->mutex);
1295                 DESTROY_IF(id);
1296                 return;
1297         }
1298
1299         /* replace/set the username in the first EAP/XAuth auth_cfg, also look for
1300          * a suitable remote ID.
1301          * note that adding the identity here is not fully thread-safe as the
1302          * peer_cfg and in turn the auth_cfg could be in use. for the default use
1303          * case (setting user credentials before upping the connection) this will
1304          * not be a problem, though. */
1305         enumerator = found->create_auth_cfg_enumerator(found, TRUE);
1306         remote_auth = found->create_auth_cfg_enumerator(found, FALSE);
1307         while (enumerator->enumerate(enumerator, (void**)&auth_cfg))
1308         {
1309                 if (remote_auth->enumerate(remote_auth, (void**)&remote_cfg))
1310                 {       /* fall back on rightid, in case aaa_identity is not specified */
1311                         identity = remote_cfg->get(remote_cfg, AUTH_RULE_IDENTITY);
1312                         if (identity && identity->get_type(identity) != ID_ANY)
1313                         {
1314                                 gw = identity;
1315                         }
1316                 }
1317
1318                 auth_class = (uintptr_t)auth_cfg->get(auth_cfg, AUTH_RULE_AUTH_CLASS);
1319                 if (auth_class == AUTH_CLASS_EAP || auth_class == AUTH_CLASS_XAUTH)
1320                 {
1321                         if (auth_class == AUTH_CLASS_EAP)
1322                         {
1323                                 auth_cfg->add(auth_cfg, AUTH_RULE_EAP_IDENTITY, id->clone(id));
1324                                 /* if aaa_identity is specified use that as remote ID */
1325                                 identity = auth_cfg->get(auth_cfg, AUTH_RULE_AAA_IDENTITY);
1326                                 if (identity && identity->get_type(identity) != ID_ANY)
1327                                 {
1328                                         gw = identity;
1329                                 }
1330                                 DBG1(DBG_CFG, "  configured EAP-Identity %Y", id);
1331                         }
1332                         else
1333                         {
1334                                 auth_cfg->add(auth_cfg, AUTH_RULE_XAUTH_IDENTITY,
1335                                                           id->clone(id));
1336                                 DBG1(DBG_CFG, "  configured XAuth username %Y", id);
1337                         }
1338                         type = SHARED_EAP;
1339                         break;
1340                 }
1341         }
1342         enumerator->destroy(enumerator);
1343         remote_auth->destroy(remote_auth);
1344         /* clone the gw ID before unlocking the mutex */
1345         if (gw)
1346         {
1347                 gw = gw->clone(gw);
1348         }
1349         this->mutex->unlock(this->mutex);
1350
1351         if (type == SHARED_ANY)
1352         {
1353                 DBG1(DBG_CFG, "  config '%s' unsuitable for user credentials",
1354                          msg->user_creds.name);
1355                 fprintf(prompt, "config '%s' unsuitable for user credentials\n",
1356                                 msg->user_creds.name);
1357                 id->destroy(id);
1358                 DESTROY_IF(gw);
1359                 return;
1360         }
1361
1362         if (msg->user_creds.password)
1363         {
1364                 char *pass;
1365
1366                 pass = msg->user_creds.password;
1367                 password = chunk_clone(chunk_create(pass, strlen(pass)));
1368                 memwipe(pass, strlen(pass));
1369         }
1370         else
1371         {       /* prompt the user for the password */
1372                 char buf[256];
1373
1374                 fprintf(prompt, "Password:\n");
1375                 if (fgets(buf, sizeof(buf), prompt))
1376                 {
1377                         password = chunk_clone(chunk_create(buf, strlen(buf)));
1378                         if (password.len > 0)
1379                         {       /* trim trailing \n */
1380                                 password.len--;
1381                         }
1382                         memwipe(buf, sizeof(buf));
1383                 }
1384         }
1385
1386         if (password.len)
1387         {
1388                 shared_key_t *shared;
1389                 linked_list_t *owners;
1390
1391                 shared = shared_key_create(type, password);
1392
1393                 owners = linked_list_create();
1394                 owners->insert_last(owners, id->clone(id));
1395                 if (gw && gw->get_type(gw) != ID_ANY)
1396                 {
1397                         owners->insert_last(owners, gw->clone(gw));
1398                         DBG1(DBG_CFG, "  added %N secret for %Y %Y", shared_key_type_names,
1399                                  type, id, gw);
1400                 }
1401                 else
1402                 {
1403                         DBG1(DBG_CFG, "  added %N secret for %Y", shared_key_type_names,
1404                                  type, id);
1405                 }
1406                 this->cred->add_shared(this->cred, shared, owners);
1407                 DBG4(DBG_CFG, "  secret: %#B", &password);
1408         }
1409         else
1410         {       /* in case a user answers the password prompt by just pressing enter */
1411                 chunk_clear(&password);
1412         }
1413         id->destroy(id);
1414         DESTROY_IF(gw);
1415 }
1416
1417 METHOD(stroke_config_t, destroy, void,
1418         private_stroke_config_t *this)
1419 {
1420         this->list->destroy_offset(this->list, offsetof(peer_cfg_t, destroy));
1421         this->mutex->destroy(this->mutex);
1422         free(this);
1423 }
1424
1425 /*
1426  * see header file
1427  */
1428 stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred,
1429                                                                           stroke_attribute_t *attributes)
1430 {
1431         private_stroke_config_t *this;
1432
1433         INIT(this,
1434                 .public = {
1435                         .backend = {
1436                                 .create_peer_cfg_enumerator = _create_peer_cfg_enumerator,
1437                                 .create_ike_cfg_enumerator = _create_ike_cfg_enumerator,
1438                                 .get_peer_cfg_by_name = _get_peer_cfg_by_name,
1439                         },
1440                         .add = _add,
1441                         .del = _del,
1442                         .set_user_credentials = _set_user_credentials,
1443                         .destroy = _destroy,
1444                 },
1445                 .list = linked_list_create(),
1446                 .mutex = mutex_create(MUTEX_TYPE_RECURSIVE),
1447                 .ca = ca,
1448                 .cred = cred,
1449                 .attributes = attributes,
1450         );
1451
1452         return &this->public;
1453 }