2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
5 * Copyright (C) 2015 Andreas Steffen
6 * HSR Hochschule fuer Technik Rapperswil
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
19 #include "stroke_list.h"
23 #include <sys/utsname.h>
27 #endif /* HAVE_MALLINFO */
30 #include <collections/linked_list.h>
31 #include <plugins/plugin.h>
32 #include <credentials/certificates/x509.h>
33 #include <credentials/certificates/certificate_printer.h>
34 #include <config/peer_cfg.h>
36 typedef struct private_stroke_list_t private_stroke_list_t
;
39 * private data of stroke_list
41 struct private_stroke_list_t
{
49 * Kind of *swan we run
54 * timestamp of daemon start
59 * strokes attribute provider
61 stroke_attribute_t
*attribute
;
65 * Static certificate printer object
67 static certificate_printer_t
*cert_printer
= NULL
;
70 * Log tasks of a specific queue to out
72 static void log_task_q(FILE *out
, ike_sa_t
*ike_sa
, task_queue_t q
, char *name
)
74 enumerator_t
*enumerator
;
78 enumerator
= ike_sa
->create_task_enumerator(ike_sa
, q
);
79 while (enumerator
->enumerate(enumerator
, &task
))
83 fprintf(out
, "%12s[%d]: Tasks %s: ", ike_sa
->get_name(ike_sa
),
84 ike_sa
->get_unique_id(ike_sa
), name
);
87 fprintf(out
, "%N ", task_type_names
, task
->get_type(task
));
89 enumerator
->destroy(enumerator
);
97 * log an IKE_SA to out
99 static void log_ike_sa(FILE *out
, ike_sa_t
*ike_sa
, bool all
)
101 ike_sa_id_t
*id
= ike_sa
->get_id(ike_sa
);
102 time_t now
= time_monotonic(NULL
);
104 fprintf(out
, "%12s[%d]: %N",
105 ike_sa
->get_name(ike_sa
), ike_sa
->get_unique_id(ike_sa
),
106 ike_sa_state_names
, ike_sa
->get_state(ike_sa
));
108 if (ike_sa
->get_state(ike_sa
) == IKE_ESTABLISHED
)
112 established
= ike_sa
->get_statistic(ike_sa
, STAT_ESTABLISHED
);
113 fprintf(out
, " %V ago", &now
, &established
);
116 fprintf(out
, ", %H[%Y]...%H[%Y]\n",
117 ike_sa
->get_my_host(ike_sa
), ike_sa
->get_my_id(ike_sa
),
118 ike_sa
->get_other_host(ike_sa
), ike_sa
->get_other_id(ike_sa
));
122 proposal_t
*ike_proposal
;
123 identification_t
*eap_id
;
125 eap_id
= ike_sa
->get_other_eap_id(ike_sa
);
127 if (!eap_id
->equals(eap_id
, ike_sa
->get_other_id(ike_sa
)))
129 fprintf(out
, "%12s[%d]: Remote %s identity: %Y\n",
130 ike_sa
->get_name(ike_sa
), ike_sa
->get_unique_id(ike_sa
),
131 ike_sa
->get_version(ike_sa
) == IKEV1
? "XAuth" : "EAP",
135 ike_proposal
= ike_sa
->get_proposal(ike_sa
);
137 fprintf(out
, "%12s[%d]: %N SPIs: %.16"PRIx64
"_i%s %.16"PRIx64
"_r%s",
138 ike_sa
->get_name(ike_sa
), ike_sa
->get_unique_id(ike_sa
),
139 ike_version_names
, ike_sa
->get_version(ike_sa
),
140 be64toh(id
->get_initiator_spi(id
)),
141 id
->is_initiator(id
) ? "*" : "",
142 be64toh(id
->get_responder_spi(id
)),
143 id
->is_initiator(id
) ? "" : "*");
146 if (ike_sa
->get_state(ike_sa
) == IKE_ESTABLISHED
)
148 time_t rekey
, reauth
;
149 peer_cfg_t
*peer_cfg
;
151 rekey
= ike_sa
->get_statistic(ike_sa
, STAT_REKEY
);
152 reauth
= ike_sa
->get_statistic(ike_sa
, STAT_REAUTH
);
153 peer_cfg
= ike_sa
->get_peer_cfg(ike_sa
);
157 fprintf(out
, ", rekeying in %V", &rekey
, &now
);
162 enumerator_t
*enumerator
;
166 enumerator
= peer_cfg
->create_auth_cfg_enumerator(peer_cfg
, TRUE
);
167 while (enumerator
->enumerate(enumerator
, &auth
))
174 fprintf(out
, "%N", auth_class_names
,
175 auth
->get(auth
, AUTH_RULE_AUTH_CLASS
));
177 enumerator
->destroy(enumerator
);
178 fprintf(out
, " reauthentication in %V", &reauth
, &now
);
180 if (!rekey
&& !reauth
)
182 fprintf(out
, ", rekeying disabled");
191 snprintf(buf
, BUF_LEN
, "%P", ike_proposal
);
192 fprintf(out
, "%12s[%d]: IKE proposal: %s\n",
193 ike_sa
->get_name(ike_sa
), ike_sa
->get_unique_id(ike_sa
),
197 log_task_q(out
, ike_sa
, TASK_QUEUE_QUEUED
, "queued");
198 log_task_q(out
, ike_sa
, TASK_QUEUE_ACTIVE
, "active");
199 log_task_q(out
, ike_sa
, TASK_QUEUE_PASSIVE
, "passive");
204 * log an CHILD_SA to out
206 static void log_child_sa(FILE *out
, child_sa_t
*child_sa
, bool all
)
208 time_t use_in
, use_out
, rekey
, now
;
209 uint64_t bytes_in
, bytes_out
, packets_in
, packets_out
;
210 proposal_t
*proposal
;
211 linked_list_t
*my_ts
, *other_ts
;
214 config
= child_sa
->get_config(child_sa
);
215 now
= time_monotonic(NULL
);
217 fprintf(out
, "%12s{%d}: %N, %N%s, reqid %u",
218 child_sa
->get_name(child_sa
), child_sa
->get_unique_id(child_sa
),
219 child_sa_state_names
, child_sa
->get_state(child_sa
),
220 ipsec_mode_names
, child_sa
->get_mode(child_sa
),
221 config
->has_option(config
, OPT_PROXY_MODE
) ? "_PROXY" : "",
222 child_sa
->get_reqid(child_sa
));
224 if (child_sa
->get_state(child_sa
) == CHILD_INSTALLED
)
226 fprintf(out
, ", %N%s SPIs: %.8x_i %.8x_o",
227 protocol_id_names
, child_sa
->get_protocol(child_sa
),
228 child_sa
->has_encap(child_sa
) ? " in UDP" : "",
229 ntohl(child_sa
->get_spi(child_sa
, TRUE
)),
230 ntohl(child_sa
->get_spi(child_sa
, FALSE
)));
232 if (child_sa
->get_ipcomp(child_sa
) != IPCOMP_NONE
)
234 fprintf(out
, ", IPCOMP CPIs: %.4x_i %.4x_o",
235 ntohs(child_sa
->get_cpi(child_sa
, TRUE
)),
236 ntohs(child_sa
->get_cpi(child_sa
, FALSE
)));
241 fprintf(out
, "\n%12s{%d}: ", child_sa
->get_name(child_sa
),
242 child_sa
->get_unique_id(child_sa
));
244 proposal
= child_sa
->get_proposal(child_sa
);
250 if (proposal
->get_algorithm(proposal
, ENCRYPTION_ALGORITHM
,
251 &alg
, &ks
) && alg
!= ENCR_UNDEFINED
)
253 fprintf(out
, "%N", encryption_algorithm_names
, alg
);
257 fprintf(out
, "_%u", ks
);
260 if (proposal
->get_algorithm(proposal
, INTEGRITY_ALGORITHM
,
261 &alg
, &ks
) && alg
!= AUTH_UNDEFINED
)
263 fprintf(out
, "%s%N", first
? "" : "/",
264 integrity_algorithm_names
, alg
);
267 fprintf(out
, "_%u", ks
);
270 if (proposal
->get_algorithm(proposal
, DIFFIE_HELLMAN_GROUP
,
273 fprintf(out
, "/%N", diffie_hellman_group_names
, alg
);
275 if (proposal
->get_algorithm(proposal
, EXTENDED_SEQUENCE_NUMBERS
,
276 &alg
, NULL
) && alg
== EXT_SEQ_NUMBERS
)
278 fprintf(out
, "/ESN");
282 child_sa
->get_usestats(child_sa
, TRUE
,
283 &use_in
, &bytes_in
, &packets_in
);
284 fprintf(out
, ", %" PRIu64
" bytes_i", bytes_in
);
287 fprintf(out
, " (%" PRIu64
" pkt%s, %" PRIu64
"s ago)",
288 packets_in
, (packets_in
== 1) ? "": "s",
289 (uint64_t)(now
- use_in
));
292 child_sa
->get_usestats(child_sa
, FALSE
,
293 &use_out
, &bytes_out
, &packets_out
);
294 fprintf(out
, ", %" PRIu64
" bytes_o", bytes_out
);
297 fprintf(out
, " (%" PRIu64
" pkt%s, %" PRIu64
"s ago)",
298 packets_out
, (packets_out
== 1) ? "": "s",
299 (uint64_t)(now
- use_out
));
301 fprintf(out
, ", rekeying ");
303 rekey
= child_sa
->get_lifetime(child_sa
, FALSE
);
308 fprintf(out
, "active");
312 fprintf(out
, "in %V", &now
, &rekey
);
317 fprintf(out
, "disabled");
322 else if (child_sa
->get_state(child_sa
) == CHILD_REKEYING
||
323 child_sa
->get_state(child_sa
) == CHILD_REKEYED
)
325 rekey
= child_sa
->get_lifetime(child_sa
, TRUE
);
326 fprintf(out
, ", expires in %V", &now
, &rekey
);
329 my_ts
= linked_list_create_from_enumerator(
330 child_sa
->create_ts_enumerator(child_sa
, TRUE
));
331 other_ts
= linked_list_create_from_enumerator(
332 child_sa
->create_ts_enumerator(child_sa
, FALSE
));
333 fprintf(out
, "\n%12s{%d}: %#R === %#R\n",
334 child_sa
->get_name(child_sa
), child_sa
->get_unique_id(child_sa
),
336 my_ts
->destroy(my_ts
);
337 other_ts
->destroy(other_ts
);
341 * Log a configs local or remote authentication config to out
343 static void log_auth_cfgs(FILE *out
, peer_cfg_t
*peer_cfg
, bool local
)
345 enumerator_t
*enumerator
, *rules
;
348 auth_class_t auth_class
;
349 identification_t
*id
;
351 cert_validation_t valid
;
354 name
= peer_cfg
->get_name(peer_cfg
);
356 enumerator
= peer_cfg
->create_auth_cfg_enumerator(peer_cfg
, local
);
357 while (enumerator
->enumerate(enumerator
, &auth
))
359 fprintf(out
, "%12s: %s", name
, local
? "local: " : "remote:");
360 id
= auth
->get(auth
, AUTH_RULE_IDENTITY
);
363 fprintf(out
, " [%Y]", id
);
365 fprintf(out
, " uses ");
367 auth_class
= (uintptr_t)auth
->get(auth
, AUTH_RULE_AUTH_CLASS
);
368 if (auth_class
== AUTH_CLASS_EAP
)
370 if ((uintptr_t)auth
->get(auth
, AUTH_RULE_EAP_TYPE
) == EAP_NAK
)
372 fprintf(out
, "EAP authentication");
376 if ((uintptr_t)auth
->get(auth
, AUTH_RULE_EAP_VENDOR
))
378 fprintf(out
, "EAP_%" PRIuPTR
"-%" PRIuPTR
" authentication",
379 (uintptr_t)auth
->get(auth
, AUTH_RULE_EAP_TYPE
),
380 (uintptr_t)auth
->get(auth
, AUTH_RULE_EAP_VENDOR
));
384 fprintf(out
, "%N authentication", eap_type_names
,
385 (uintptr_t)auth
->get(auth
, AUTH_RULE_EAP_TYPE
));
388 id
= auth
->get(auth
, AUTH_RULE_EAP_IDENTITY
);
391 fprintf(out
, " with EAP identity '%Y'", id
);
395 else if (auth_class
== AUTH_CLASS_XAUTH
)
397 fprintf(out
, "%N authentication: %s", auth_class_names
, auth_class
,
398 auth
->get(auth
, AUTH_RULE_XAUTH_BACKEND
) ?: "any");
399 id
= auth
->get(auth
, AUTH_RULE_XAUTH_IDENTITY
);
402 fprintf(out
, " with XAuth identity '%Y'", id
);
408 fprintf(out
, "%N authentication\n", auth_class_names
, auth_class
);
411 cert
= auth
->get(auth
, AUTH_RULE_CA_CERT
);
414 fprintf(out
, "%12s: ca: \"%Y\"\n", name
, cert
->get_subject(cert
));
417 cert
= auth
->get(auth
, AUTH_RULE_IM_CERT
);
420 fprintf(out
, "%12s: im-ca: \"%Y\"\n", name
, cert
->get_subject(cert
));
423 cert
= auth
->get(auth
, AUTH_RULE_SUBJECT_CERT
);
426 fprintf(out
, "%12s: cert: \"%Y\"\n", name
,
427 cert
->get_subject(cert
));
430 valid
= (uintptr_t)auth
->get(auth
, AUTH_RULE_OCSP_VALIDATION
);
431 if (valid
!= VALIDATION_FAILED
)
433 fprintf(out
, "%12s: ocsp: status must be GOOD%s\n", name
,
434 (valid
== VALIDATION_SKIPPED
) ? " or SKIPPED" : "");
437 valid
= (uintptr_t)auth
->get(auth
, AUTH_RULE_CRL_VALIDATION
);
438 if (valid
!= VALIDATION_FAILED
)
440 fprintf(out
, "%12s: crl: status must be GOOD%s\n", name
,
441 (valid
== VALIDATION_SKIPPED
) ? " or SKIPPED" : "");
444 rules
= auth
->create_enumerator(auth
);
445 while (rules
->enumerate(rules
, &rule
, &id
))
447 if (rule
== AUTH_RULE_GROUP
)
449 fprintf(out
, "%12s: group: %Y\n", name
, id
);
452 rules
->destroy(rules
);
454 enumerator
->destroy(enumerator
);
457 METHOD(stroke_list_t
, status
, void,
458 private_stroke_list_t
*this, stroke_msg_t
*msg
, FILE *out
,
461 enumerator_t
*enumerator
, *children
;
463 child_cfg_t
*child_cfg
;
464 child_sa_t
*child_sa
;
466 linked_list_t
*my_ts
, *other_ts
;
467 bool first
, found
= FALSE
;
468 char *name
= msg
->status
.name
;
473 peer_cfg_t
*peer_cfg
;
474 ike_version_t ike_version
;
479 u_int size
, online
, offline
, i
;
480 struct utsname utsname
;
482 now
= time_monotonic(NULL
);
483 since
= time(NULL
) - (now
- this->uptime
);
485 fprintf(out
, "Status of IKE charon daemon (%sSwan "VERSION
, this->swan
);
486 if (uname(&utsname
) == 0)
488 fprintf(out
, ", %s %s, %s",
489 utsname
.sysname
, utsname
.release
, utsname
.machine
);
491 fprintf(out
, "):\n uptime: %V, since %T\n", &now
, &this->uptime
, &since
,
495 struct mallinfo mi
= mallinfo();
497 fprintf(out
, " malloc: sbrk %u, mmap %u, used %u, free %u\n",
498 mi
.arena
, mi
.hblkhd
, mi
.uordblks
, mi
.fordblks
);
500 #endif /* HAVE_MALLINFO */
501 fprintf(out
, " worker threads: %d of %d idle, ",
502 lib
->processor
->get_idle_threads(lib
->processor
),
503 lib
->processor
->get_total_threads(lib
->processor
));
504 for (i
= 0; i
< JOB_PRIO_MAX
; i
++)
506 fprintf(out
, "%s%d", i
== 0 ? "" : "/",
507 lib
->processor
->get_working_threads(lib
->processor
, i
));
509 fprintf(out
, " working, job queue: ");
510 for (i
= 0; i
< JOB_PRIO_MAX
; i
++)
512 fprintf(out
, "%s%d", i
== 0 ? "" : "/",
513 lib
->processor
->get_job_load(lib
->processor
, i
));
515 fprintf(out
, ", scheduled: %d\n",
516 lib
->scheduler
->get_job_load(lib
->scheduler
));
517 fprintf(out
, " loaded plugins: %s\n",
518 lib
->plugins
->loaded_plugins(lib
->plugins
));
521 enumerator
= this->attribute
->create_pool_enumerator(this->attribute
);
522 while (enumerator
->enumerate(enumerator
, &pool
, &size
, &online
, &offline
))
524 if (name
&& !streq(name
, pool
))
531 fprintf(out
, "Virtual IP pools (size/online/offline):\n");
533 fprintf(out
, " %s: %u/%u/%u\n", pool
, size
, online
, offline
);
535 enumerator
->destroy(enumerator
);
537 enumerator
= charon
->kernel
->create_address_enumerator(charon
->kernel
,
539 fprintf(out
, "Listening IP addresses:\n");
540 while (enumerator
->enumerate(enumerator
, (void**)&host
))
542 fprintf(out
, " %H\n", host
);
544 enumerator
->destroy(enumerator
);
546 fprintf(out
, "Connections:\n");
547 enumerator
= charon
->backends
->create_peer_cfg_enumerator(
548 charon
->backends
, NULL
, NULL
, NULL
, NULL
, IKE_ANY
);
549 while (enumerator
->enumerate(enumerator
, &peer_cfg
))
551 char *my_addr
, *other_addr
;
553 if (name
&& !streq(name
, peer_cfg
->get_name(peer_cfg
)))
558 ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
559 ike_version
= peer_cfg
->get_ike_version(peer_cfg
);
560 my_addr
= ike_cfg
->get_my_addr(ike_cfg
);
561 other_addr
= ike_cfg
->get_other_addr(ike_cfg
);
562 fprintf(out
, "%12s: %s...%s %N", peer_cfg
->get_name(peer_cfg
),
563 my_addr
, other_addr
, ike_version_names
, ike_version
);
565 if (ike_version
== IKEV1
&& peer_cfg
->use_aggressive(peer_cfg
))
567 fprintf(out
, " Aggressive");
570 dpd
= peer_cfg
->get_dpd(peer_cfg
);
573 fprintf(out
, ", dpddelay=%us", dpd
);
577 log_auth_cfgs(out
, peer_cfg
, TRUE
);
578 log_auth_cfgs(out
, peer_cfg
, FALSE
);
580 children
= peer_cfg
->create_child_cfg_enumerator(peer_cfg
);
581 while (children
->enumerate(children
, &child_cfg
))
583 my_ts
= child_cfg
->get_traffic_selectors(child_cfg
, TRUE
, NULL
, NULL
);
584 other_ts
= child_cfg
->get_traffic_selectors(child_cfg
, FALSE
, NULL
, NULL
);
585 fprintf(out
, "%12s: child: %#R === %#R %N",
586 child_cfg
->get_name(child_cfg
), my_ts
, other_ts
,
587 ipsec_mode_names
, child_cfg
->get_mode(child_cfg
));
588 my_ts
->destroy_offset(my_ts
, offsetof(traffic_selector_t
, destroy
));
589 other_ts
->destroy_offset(other_ts
, offsetof(traffic_selector_t
, destroy
));
593 fprintf(out
, ", dpdaction=%N", action_names
,
594 child_cfg
->get_dpd_action(child_cfg
));
598 children
->destroy(children
);
600 enumerator
->destroy(enumerator
);
603 /* Enumerate shunt policies */
605 enumerator
= charon
->shunts
->create_enumerator(charon
->shunts
);
606 while (enumerator
->enumerate(enumerator
, NULL
, &child_cfg
))
608 if (name
&& !streq(name
, child_cfg
->get_name(child_cfg
)))
614 fprintf(out
, "Shunted Connections:\n");
617 my_ts
= child_cfg
->get_traffic_selectors(child_cfg
, TRUE
, NULL
, NULL
);
618 other_ts
= child_cfg
->get_traffic_selectors(child_cfg
, FALSE
, NULL
, NULL
);
619 fprintf(out
, "%12s: %#R === %#R %N\n",
620 child_cfg
->get_name(child_cfg
), my_ts
, other_ts
,
621 ipsec_mode_names
, child_cfg
->get_mode(child_cfg
));
622 my_ts
->destroy_offset(my_ts
, offsetof(traffic_selector_t
, destroy
));
623 other_ts
->destroy_offset(other_ts
, offsetof(traffic_selector_t
, destroy
));
625 enumerator
->destroy(enumerator
);
627 /* Enumerate traps */
629 enumerator
= charon
->traps
->create_enumerator(charon
->traps
);
630 while (enumerator
->enumerate(enumerator
, NULL
, &child_sa
))
632 if (name
&& !streq(name
, child_sa
->get_name(child_sa
)))
638 fprintf(out
, "Routed Connections:\n");
641 log_child_sa(out
, child_sa
, all
);
643 enumerator
->destroy(enumerator
);
645 half_open
= charon
->ike_sa_manager
->get_half_open_count(
646 charon
->ike_sa_manager
, NULL
, FALSE
);
647 fprintf(out
, "Security Associations (%u up, %u connecting):\n",
648 charon
->ike_sa_manager
->get_count(charon
->ike_sa_manager
) - half_open
,
650 enumerator
= charon
->controller
->create_ike_sa_enumerator(
651 charon
->controller
, wait
);
652 while (enumerator
->enumerate(enumerator
, &ike_sa
) && ferror(out
) == 0)
654 bool ike_printed
= FALSE
;
655 enumerator_t
*children
= ike_sa
->create_child_sa_enumerator(ike_sa
);
657 if (name
== NULL
|| streq(name
, ike_sa
->get_name(ike_sa
)))
659 log_ike_sa(out
, ike_sa
, all
);
664 while (children
->enumerate(children
, (void**)&child_sa
))
666 if (name
== NULL
|| streq(name
, child_sa
->get_name(child_sa
)))
670 log_ike_sa(out
, ike_sa
, all
);
674 log_child_sa(out
, child_sa
, all
);
677 children
->destroy(children
);
679 enumerator
->destroy(enumerator
);
685 fprintf(out
, " no match\n");
689 fprintf(out
, " none\n");
695 * create a unique certificate list without duplicates
696 * certicates having the same issuer are grouped together.
698 static linked_list_t
* create_unique_cert_list(certificate_type_t type
)
700 linked_list_t
*list
= linked_list_create();
701 enumerator_t
*enumerator
= lib
->credmgr
->create_cert_enumerator(
702 lib
->credmgr
, type
, KEY_ANY
, NULL
, FALSE
);
705 while (enumerator
->enumerate(enumerator
, (void**)&cert
))
707 enumerator_t
*added
= list
->create_enumerator(list
);
708 identification_t
*issuer
= cert
->get_issuer(cert
);
709 bool previous_same
, same
= FALSE
, found
= FALSE
;
710 certificate_t
*list_cert
;
712 while (added
->enumerate(added
, (void**)&list_cert
))
714 if (list_cert
->equals(list_cert
, cert
))
715 { /* stop if we found a duplicate*/
719 previous_same
= same
;
720 same
= list_cert
->has_issuer(list_cert
, issuer
);
721 if (previous_same
&& !same
)
722 { /* group certificates with same issuer */
728 list
->insert_before(list
, added
, cert
->get_ref(cert
));
730 added
->destroy(added
);
732 enumerator
->destroy(enumerator
);
737 * Is there a matching private key?
739 static bool has_privkey(certificate_t
*cert
)
741 public_key_t
*public;
742 private_key_t
*private = NULL
;
744 identification_t
*id
;
746 public = cert
->get_public_key(cert
);
751 if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1
, &keyid
))
753 id
= identification_create_from_encoding(ID_KEY_ID
, keyid
);
754 private = lib
->credmgr
->get_private(lib
->credmgr
,
755 public->get_type(public), id
, NULL
);
758 public->destroy(public);
761 return (private != NULL
);
765 * list all X.509 certificates matching the flags
767 static void stroke_list_x509_certs(linked_list_t
*list
, x509_flag_t flag
)
769 enumerator_t
*enumerator
;
772 enumerator
= list
->create_enumerator(list
);
773 while (enumerator
->enumerate(enumerator
, (void**)&cert
))
775 x509_t
*x509
= (x509_t
*)cert
;
776 x509_flag_t flags
= x509
->get_flags(x509
) & X509_ANY
;
778 /* list only if flag is set or flag == 0 */
779 if ((flags
& flag
) || flags
== flag
)
781 cert_printer
->print_caption(cert_printer
, CERT_X509
, flag
);
782 cert_printer
->print(cert_printer
, cert
, has_privkey(cert
));
785 enumerator
->destroy(enumerator
);
789 * list all other certificates types
791 static void stroke_list_other_certs(certificate_type_t type
)
793 enumerator_t
*enumerator
;
797 list
= create_unique_cert_list(type
);
799 enumerator
= list
->create_enumerator(list
);
800 while (enumerator
->enumerate(enumerator
, &cert
))
802 cert_printer
->print_caption(cert_printer
, cert
->get_type(cert
), X509_NONE
);
803 cert_printer
->print(cert_printer
, cert
, has_privkey(cert
));
805 enumerator
->destroy(enumerator
);
807 list
->destroy_offset(list
, offsetof(certificate_t
, destroy
));
811 * Print the name of an algorithm plus the name of the plugin that registered it
813 static void print_alg(FILE *out
, int *len
, enum_name_t
*alg_names
, int alg_type
,
814 const char *plugin_name
)
816 char alg_name
[BUF_LEN
];
821 alg_name_len
= sprintf(alg_name
, " %N[%s]", alg_names
, alg_type
,
826 alg_name_len
= sprintf(alg_name
, " [%s]", plugin_name
);
828 if (*len
+ alg_name_len
> CRYPTO_MAX_ALG_LINE
)
833 fprintf(out
, "%s", alg_name
);
834 *len
+= alg_name_len
;
838 * List of registered cryptographical algorithms
840 static void list_algs(FILE *out
)
842 enumerator_t
*enumerator
;
843 encryption_algorithm_t encryption
;
844 integrity_algorithm_t integrity
;
845 hash_algorithm_t hash
;
846 pseudo_random_function_t prf
;
847 ext_out_function_t xof
;
848 diffie_hellman_group_t group
;
849 rng_quality_t quality
;
850 const char *plugin_name
;
854 fprintf(out
, "List of registered IKE algorithms:\n");
855 fprintf(out
, "\n encryption:");
857 enumerator
= lib
->crypto
->create_crypter_enumerator(lib
->crypto
);
858 while (enumerator
->enumerate(enumerator
, &encryption
, &plugin_name
))
860 print_alg(out
, &len
, encryption_algorithm_names
, encryption
, plugin_name
);
862 enumerator
->destroy(enumerator
);
863 fprintf(out
, "\n integrity: ");
865 enumerator
= lib
->crypto
->create_signer_enumerator(lib
->crypto
);
866 while (enumerator
->enumerate(enumerator
, &integrity
, &plugin_name
))
868 print_alg(out
, &len
, integrity_algorithm_names
, integrity
, plugin_name
);
870 enumerator
->destroy(enumerator
);
871 fprintf(out
, "\n aead: ");
873 enumerator
= lib
->crypto
->create_aead_enumerator(lib
->crypto
);
874 while (enumerator
->enumerate(enumerator
, &encryption
, &plugin_name
))
876 print_alg(out
, &len
, encryption_algorithm_names
, encryption
, plugin_name
);
878 enumerator
->destroy(enumerator
);
879 fprintf(out
, "\n hasher: ");
881 enumerator
= lib
->crypto
->create_hasher_enumerator(lib
->crypto
);
882 while (enumerator
->enumerate(enumerator
, &hash
, &plugin_name
))
884 print_alg(out
, &len
, hash_algorithm_names
, hash
, plugin_name
);
886 enumerator
->destroy(enumerator
);
887 fprintf(out
, "\n prf: ");
889 enumerator
= lib
->crypto
->create_prf_enumerator(lib
->crypto
);
890 while (enumerator
->enumerate(enumerator
, &prf
, &plugin_name
))
892 print_alg(out
, &len
, pseudo_random_function_names
, prf
, plugin_name
);
894 enumerator
->destroy(enumerator
);
895 fprintf(out
, "\n xof: ");
897 enumerator
= lib
->crypto
->create_xof_enumerator(lib
->crypto
);
898 while (enumerator
->enumerate(enumerator
, &xof
, &plugin_name
))
900 print_alg(out
, &len
, ext_out_function_names
, xof
, plugin_name
);
902 enumerator
->destroy(enumerator
);
903 fprintf(out
, "\n dh-group: ");
905 enumerator
= lib
->crypto
->create_dh_enumerator(lib
->crypto
);
906 while (enumerator
->enumerate(enumerator
, &group
, &plugin_name
))
908 print_alg(out
, &len
, diffie_hellman_group_names
, group
, plugin_name
);
910 enumerator
->destroy(enumerator
);
911 fprintf(out
, "\n random-gen:");
913 enumerator
= lib
->crypto
->create_rng_enumerator(lib
->crypto
);
914 while (enumerator
->enumerate(enumerator
, &quality
, &plugin_name
))
916 print_alg(out
, &len
, rng_quality_names
, quality
, plugin_name
);
918 enumerator
->destroy(enumerator
);
919 fprintf(out
, "\n nonce-gen: ");
921 enumerator
= lib
->crypto
->create_nonce_gen_enumerator(lib
->crypto
);
922 while (enumerator
->enumerate(enumerator
, &plugin_name
))
924 print_alg(out
, &len
, NULL
, 0, plugin_name
);
926 enumerator
->destroy(enumerator
);
931 * List loaded plugin information
933 static void list_plugins(FILE *out
)
935 plugin_feature_t
*features
, *fp
;
936 enumerator_t
*enumerator
;
944 fprintf(out
, "List of loaded Plugins:\n");
947 enumerator
= lib
->plugins
->create_plugin_enumerator(lib
->plugins
);
948 while (enumerator
->enumerate(enumerator
, &plugin
, &list
))
950 fprintf(out
, "%s:\n", plugin
->get_name(plugin
));
951 if (plugin
->get_features
)
953 count
= plugin
->get_features(plugin
, &features
);
954 for (i
= 0; i
< count
; i
++)
956 str
= plugin_feature_get_string(&features
[i
]);
957 switch (features
[i
].kind
)
959 case FEATURE_PROVIDE
:
961 loaded
= list
->find_first(list
, NULL
, (void**)&fp
);
962 fprintf(out
, " %s%s\n",
963 str
, loaded
? "" : " (not loaded)");
965 case FEATURE_DEPENDS
:
966 fprintf(out
, " %s\n", str
);
968 case FEATURE_SDEPEND
:
969 fprintf(out
, " %s (soft)\n", str
);
979 enumerator
->destroy(enumerator
);
982 METHOD(stroke_list_t
, list
, void,
983 private_stroke_list_t
*this, stroke_msg_t
*msg
, FILE *out
)
985 linked_list_t
*cert_list
= NULL
;
987 cert_printer
= certificate_printer_create(out
, TRUE
, msg
->list
.utc
);
989 if (msg
->list
.flags
& LIST_PUBKEYS
)
991 stroke_list_other_certs(CERT_TRUSTED_PUBKEY
);
993 if (msg
->list
.flags
& LIST_CERTS
)
995 stroke_list_other_certs(CERT_GPG
);
997 if (msg
->list
.flags
& (LIST_CERTS
| LIST_CACERTS
| LIST_OCSPCERTS
| LIST_AACERTS
))
999 cert_list
= create_unique_cert_list(CERT_X509
);
1001 if (msg
->list
.flags
& LIST_CERTS
)
1003 stroke_list_x509_certs(cert_list
, X509_NONE
);
1005 if (msg
->list
.flags
& LIST_CACERTS
)
1007 stroke_list_x509_certs(cert_list
, X509_CA
);
1009 if (msg
->list
.flags
& LIST_OCSPCERTS
)
1011 stroke_list_x509_certs(cert_list
, X509_OCSP_SIGNER
);
1013 if (msg
->list
.flags
& LIST_AACERTS
)
1015 stroke_list_x509_certs(cert_list
, X509_AA
);
1017 DESTROY_OFFSET_IF(cert_list
, offsetof(certificate_t
, destroy
));
1019 if (msg
->list
.flags
& LIST_ACERTS
)
1021 stroke_list_other_certs(CERT_X509_AC
);
1023 if (msg
->list
.flags
& LIST_CRLS
)
1025 stroke_list_other_certs(CERT_X509_CRL
);
1027 if (msg
->list
.flags
& LIST_OCSP
)
1029 stroke_list_other_certs(CERT_X509_OCSP_RESPONSE
);
1031 if (msg
->list
.flags
& LIST_ALGS
)
1035 if (msg
->list
.flags
& LIST_PLUGINS
)
1039 cert_printer
->destroy(cert_printer
);
1040 cert_printer
= NULL
;
1044 * Print leases of a single pool
1046 static void pool_leases(private_stroke_list_t
*this, FILE *out
, char *pool
,
1047 host_t
*address
, u_int size
, u_int online
, u_int offline
)
1049 enumerator_t
*enumerator
;
1050 identification_t
*id
;
1055 fprintf(out
, "Leases in pool '%s', usage: %u/%u, %u online\n",
1056 pool
, online
+ offline
, size
, online
);
1057 enumerator
= this->attribute
->create_lease_enumerator(this->attribute
, pool
);
1058 while (enumerator
&& enumerator
->enumerate(enumerator
, &id
, &lease
, &on
))
1060 if (!address
|| address
->ip_equals(address
, lease
))
1062 fprintf(out
, " %15H %s '%Y'\n",
1063 lease
, on
? "online" : "offline", id
);
1067 enumerator
->destroy(enumerator
);
1070 fprintf(out
, " no matching leases found\n");
1074 METHOD(stroke_list_t
, leases
, void,
1075 private_stroke_list_t
*this, stroke_msg_t
*msg
, FILE *out
)
1077 enumerator_t
*enumerator
;
1078 u_int size
, offline
, online
;
1079 host_t
*address
= NULL
;
1083 if (msg
->leases
.address
)
1085 address
= host_create_from_string(msg
->leases
.address
, 0);
1088 enumerator
= this->attribute
->create_pool_enumerator(this->attribute
);
1089 while (enumerator
->enumerate(enumerator
, &pool
, &size
, &online
, &offline
))
1091 if (!msg
->leases
.pool
|| streq(msg
->leases
.pool
, pool
))
1093 pool_leases(this, out
, pool
, address
, size
, online
, offline
);
1097 enumerator
->destroy(enumerator
);
1100 if (msg
->leases
.pool
)
1102 fprintf(out
, "pool '%s' not found\n", msg
->leases
.pool
);
1106 fprintf(out
, "no pools found\n");
1109 DESTROY_IF(address
);
1112 METHOD(stroke_list_t
, destroy
, void,
1113 private_stroke_list_t
*this)
1121 stroke_list_t
*stroke_list_create(stroke_attribute_t
*attribute
)
1123 private_stroke_list_t
*this;
1130 .destroy
= _destroy
,
1132 .uptime
= time_monotonic(NULL
),
1134 .attribute
= attribute
,
1137 if (lib
->settings
->get_bool(lib
->settings
,
1138 "charon.i_dont_care_about_security_and_use_aggressive_mode_psk", FALSE
))
1140 this->swan
= "weak";
1143 return &this->public;