714 lines
15 KiB
C
714 lines
15 KiB
C
/* whack communicating routines
|
|
* Copyright (C) 1997 Angelos D. Keromytis.
|
|
* Copyright (C) 1998-2001 D. Hugh Redelmeier.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* for more details.
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stddef.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
#include <sys/types.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/un.h>
|
|
#include <netinet/in.h>
|
|
#include <arpa/inet.h>
|
|
#include <resolv.h>
|
|
#include <arpa/nameser.h> /* missing from <resolv.h> on old systems */
|
|
#include <sys/queue.h>
|
|
#include <fcntl.h>
|
|
|
|
#include <freeswan.h>
|
|
|
|
#include "constants.h"
|
|
#include "defs.h"
|
|
#include "ca.h"
|
|
#include "certs.h"
|
|
#include "ac.h"
|
|
#include "smartcard.h"
|
|
#include "connections.h"
|
|
#include "foodgroups.h"
|
|
#include "whack.h" /* needs connections.h */
|
|
#include "packet.h"
|
|
#include "demux.h" /* needs packet.h */
|
|
#include "state.h"
|
|
#include "ipsec_doi.h" /* needs demux.h and state.h */
|
|
#include "kernel.h"
|
|
#include "rcv_whack.h"
|
|
#include "log.h"
|
|
#include "keys.h"
|
|
#include "adns.h" /* needs <resolv.h> */
|
|
#include "dnskey.h" /* needs keys.h and adns.h */
|
|
#include "server.h"
|
|
#include "fetch.h"
|
|
#include "ocsp.h"
|
|
#include "crl.h"
|
|
#include "myid.h"
|
|
#include "kernel_alg.h"
|
|
#include "ike_alg.h"
|
|
#include "whack_attribute.h"
|
|
|
|
/* helper variables and function to decode strings from whack message */
|
|
|
|
static char *next_str
|
|
, *str_roof;
|
|
|
|
static bool unpack_str(char **p)
|
|
{
|
|
char *end = memchr(next_str, '\0', str_roof - next_str);
|
|
|
|
if (end == NULL)
|
|
{
|
|
return FALSE; /* fishy: no end found */
|
|
}
|
|
else
|
|
{
|
|
*p = next_str == end? NULL : next_str;
|
|
next_str = end + 1;
|
|
return TRUE;
|
|
}
|
|
}
|
|
|
|
/* bits loading keys from asynchronous DNS */
|
|
|
|
enum key_add_attempt {
|
|
ka_TXT,
|
|
#ifdef USE_KEYRR
|
|
ka_KEY,
|
|
#endif
|
|
ka_roof /* largest value + 1 */
|
|
};
|
|
|
|
struct key_add_common {
|
|
int refCount;
|
|
char *diag[ka_roof];
|
|
int whack_fd;
|
|
bool success;
|
|
};
|
|
|
|
struct key_add_continuation {
|
|
struct adns_continuation ac; /* common prefix */
|
|
struct key_add_common *common; /* common data */
|
|
enum key_add_attempt lookingfor;
|
|
};
|
|
|
|
static void key_add_ugh(identification_t *keyid, err_t ugh)
|
|
{
|
|
loglog(RC_NOKEY, "failure to fetch key for %'Y' from DNS: %s", keyid, ugh);
|
|
}
|
|
|
|
/* last one out: turn out the lights */
|
|
static void key_add_merge(struct key_add_common *oc, identification_t *keyid)
|
|
{
|
|
if (oc->refCount == 0)
|
|
{
|
|
enum key_add_attempt kaa;
|
|
|
|
/* if no success, print all diagnostics */
|
|
if (!oc->success)
|
|
{
|
|
for (kaa = ka_TXT; kaa != ka_roof; kaa++)
|
|
{
|
|
key_add_ugh(keyid, oc->diag[kaa]);
|
|
}
|
|
}
|
|
for (kaa = ka_TXT; kaa != ka_roof; kaa++)
|
|
{
|
|
free(oc->diag[kaa]);
|
|
}
|
|
close(oc->whack_fd);
|
|
free(oc);
|
|
}
|
|
}
|
|
|
|
static void key_add_continue(struct adns_continuation *ac, err_t ugh)
|
|
{
|
|
struct key_add_continuation *kc = (void *) ac;
|
|
struct key_add_common *oc = kc->common;
|
|
|
|
passert(whack_log_fd == NULL_FD);
|
|
whack_log_fd = oc->whack_fd;
|
|
|
|
if (ugh != NULL)
|
|
{
|
|
oc->diag[kc->lookingfor] = clone_str(ugh);
|
|
}
|
|
else
|
|
{
|
|
oc->success = TRUE;
|
|
transfer_to_public_keys(kc->ac.gateways_from_dns
|
|
#ifdef USE_KEYRR
|
|
, &kc->ac.keys_from_dns
|
|
#endif /* USE_KEYRR */
|
|
);
|
|
}
|
|
|
|
oc->refCount--;
|
|
key_add_merge(oc, ac->id);
|
|
whack_log_fd = NULL_FD;
|
|
}
|
|
|
|
static void key_add_request(const whack_message_t *msg)
|
|
{
|
|
identification_t *key_id;
|
|
|
|
key_id = identification_create_from_string(msg->keyid);
|
|
|
|
if (!msg->whack_addkey)
|
|
{
|
|
delete_public_keys(key_id, msg->pubkey_alg, NULL, chunk_empty);
|
|
}
|
|
if (msg->keyval.len == 0)
|
|
{
|
|
struct key_add_common *oc = malloc_thing(struct key_add_common);
|
|
enum key_add_attempt kaa;
|
|
err_t ugh;
|
|
|
|
/* initialize state shared by queries */
|
|
oc->refCount = 0;
|
|
oc->whack_fd = dup_any(whack_log_fd);
|
|
oc->success = FALSE;
|
|
|
|
for (kaa = ka_TXT; kaa != ka_roof; kaa++)
|
|
{
|
|
struct key_add_continuation *kc;
|
|
|
|
oc->diag[kaa] = NULL;
|
|
oc->refCount++;
|
|
kc = malloc_thing(struct key_add_continuation);
|
|
kc->common = oc;
|
|
kc->lookingfor = kaa;
|
|
|
|
switch (kaa)
|
|
{
|
|
case ka_TXT:
|
|
ugh = start_adns_query(key_id
|
|
, key_id /* same */
|
|
, T_TXT
|
|
, key_add_continue
|
|
, &kc->ac);
|
|
break;
|
|
#ifdef USE_KEYRR
|
|
case ka_KEY:
|
|
ugh = start_adns_query(key_id
|
|
, NULL
|
|
, T_KEY
|
|
, key_add_continue
|
|
, &kc->ac);
|
|
break;
|
|
#endif /* USE_KEYRR */
|
|
default:
|
|
bad_case(kaa); /* suppress gcc warning */
|
|
}
|
|
if (ugh)
|
|
{
|
|
oc->diag[kaa] = clone_str(ugh);
|
|
oc->refCount--;
|
|
}
|
|
}
|
|
|
|
/* Done launching queries. Handle total failure case. */
|
|
key_add_merge(oc, key_id);
|
|
}
|
|
else
|
|
{
|
|
if (!add_public_key(key_id, DAL_LOCAL, msg->pubkey_alg, msg->keyval,
|
|
&pubkeys))
|
|
{
|
|
loglog(RC_LOG_SERIOUS, "failed to add public key");
|
|
}
|
|
}
|
|
key_id->destroy(key_id);
|
|
}
|
|
|
|
/* Handle a kernel request. Supposedly, there's a message in
|
|
* the kernelsock socket.
|
|
*/
|
|
void whack_handle(int whackctlfd)
|
|
{
|
|
whack_message_t msg;
|
|
struct sockaddr_un whackaddr;
|
|
int whackaddrlen = sizeof(whackaddr);
|
|
int whackfd = accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen);
|
|
/* Note: actual value in n should fit in int. To print, cast to int. */
|
|
ssize_t n;
|
|
|
|
if (whackfd < 0)
|
|
{
|
|
log_errno((e, "accept() failed in whack_handle()"));
|
|
return;
|
|
}
|
|
if (fcntl(whackfd, F_SETFD, FD_CLOEXEC) < 0)
|
|
{
|
|
log_errno((e, "failed to set CLOEXEC in whack_handle()"));
|
|
close(whackfd);
|
|
return;
|
|
}
|
|
|
|
n = read(whackfd, &msg, sizeof(msg));
|
|
|
|
if (n == -1)
|
|
{
|
|
log_errno((e, "read() failed in whack_handle()"));
|
|
close(whackfd);
|
|
return;
|
|
}
|
|
|
|
whack_log_fd = whackfd;
|
|
|
|
/* sanity check message */
|
|
{
|
|
err_t ugh = NULL;
|
|
|
|
next_str = msg.string;
|
|
str_roof = (char *)&msg + n;
|
|
|
|
if ((size_t)n < offsetof(whack_message_t, whack_shutdown) + sizeof(msg.whack_shutdown))
|
|
{
|
|
ugh = builddiag("ignoring runt message from whack: got %d bytes", (int)n);
|
|
}
|
|
else if (msg.magic != WHACK_MAGIC)
|
|
{
|
|
if (msg.magic == WHACK_BASIC_MAGIC)
|
|
{
|
|
/* Only shutdown command. Simpler inter-version compatability. */
|
|
if (msg.whack_shutdown)
|
|
{
|
|
plog("shutting down");
|
|
exit_pluto(0); /* delete lock and leave, with 0 status */
|
|
}
|
|
ugh = ""; /* bail early, but without complaint */
|
|
}
|
|
else
|
|
{
|
|
ugh = builddiag("ignoring message from whack with bad magic %d; should be %d; probably wrong version"
|
|
, msg.magic, WHACK_MAGIC);
|
|
}
|
|
}
|
|
else if (next_str > str_roof)
|
|
{
|
|
ugh = builddiag("ignoring truncated message from whack: got %d bytes; expected %u"
|
|
, (int) n, (unsigned) sizeof(msg));
|
|
}
|
|
else if (!unpack_str(&msg.name) /* string 1 */
|
|
|| !unpack_str(&msg.left.id) /* string 2 */
|
|
|| !unpack_str(&msg.left.cert) /* string 3 */
|
|
|| !unpack_str(&msg.left.ca) /* string 4 */
|
|
|| !unpack_str(&msg.left.groups) /* string 5 */
|
|
|| !unpack_str(&msg.left.updown) /* string 6 */
|
|
|| !unpack_str(&msg.left.sourceip) /* string 7 */
|
|
|| !unpack_str(&msg.left.virt) /* string 8 */
|
|
|| !unpack_str(&msg.right.id) /* string 9 */
|
|
|| !unpack_str(&msg.right.cert) /* string 10 */
|
|
|| !unpack_str(&msg.right.ca) /* string 11 */
|
|
|| !unpack_str(&msg.right.groups) /* string 12 */
|
|
|| !unpack_str(&msg.right.updown) /* string 13 */
|
|
|| !unpack_str(&msg.right.sourceip) /* string 14 */
|
|
|| !unpack_str(&msg.right.virt) /* string 15 */
|
|
|| !unpack_str(&msg.keyid) /* string 16 */
|
|
|| !unpack_str(&msg.myid) /* string 17 */
|
|
|| !unpack_str(&msg.cacert) /* string 18 */
|
|
|| !unpack_str(&msg.ldaphost) /* string 19 */
|
|
|| !unpack_str(&msg.ldapbase) /* string 20 */
|
|
|| !unpack_str(&msg.crluri) /* string 21 */
|
|
|| !unpack_str(&msg.crluri2) /* string 22 */
|
|
|| !unpack_str(&msg.ocspuri) /* string 23 */
|
|
|| !unpack_str(&msg.ike) /* string 24 */
|
|
|| !unpack_str(&msg.esp) /* string 25 */
|
|
|| !unpack_str(&msg.sc_data) /* string 26 */
|
|
|| !unpack_str(&msg.whack_lease_ip) /* string 27 */
|
|
|| !unpack_str(&msg.whack_lease_id) /* string 28 */
|
|
|| !unpack_str(&msg.xauth_identity) /* string 29 */
|
|
|| str_roof - next_str != (ptrdiff_t)msg.keyval.len) /* check chunk */
|
|
{
|
|
ugh = "message from whack contains bad string";
|
|
}
|
|
else
|
|
{
|
|
msg.keyval.ptr = next_str; /* grab chunk */
|
|
}
|
|
|
|
if (ugh != NULL)
|
|
{
|
|
if (*ugh != '\0')
|
|
loglog(RC_BADWHACKMESSAGE, "%s", ugh);
|
|
whack_log_fd = NULL_FD;
|
|
close(whackfd);
|
|
return;
|
|
}
|
|
}
|
|
|
|
if (msg.whack_options)
|
|
{
|
|
#ifdef DEBUG
|
|
if (msg.name == NULL)
|
|
{
|
|
/* we do a two-step so that if either old or new would
|
|
* cause the message to print, it will be printed.
|
|
*/
|
|
cur_debugging |= msg.debugging;
|
|
DBG(DBG_CONTROL
|
|
, DBG_log("base debugging = %s"
|
|
, bitnamesof(debug_bit_names, msg.debugging)));
|
|
cur_debugging = base_debugging = msg.debugging;
|
|
}
|
|
else if (!msg.whack_connection)
|
|
{
|
|
connection_t *c = con_by_name(msg.name, TRUE);
|
|
|
|
if (c != NULL)
|
|
{
|
|
c->extra_debugging = msg.debugging;
|
|
DBG(DBG_CONTROL
|
|
, DBG_log("\"%s\" extra_debugging = %s"
|
|
, c->name
|
|
, bitnamesof(debug_bit_names, c->extra_debugging)));
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
if (msg.whack_myid)
|
|
{
|
|
set_myid(MYID_SPECIFIED, msg.myid);
|
|
}
|
|
|
|
/* Deleting combined with adding a connection works as replace.
|
|
* To make this more useful, in only this combination,
|
|
* delete will silently ignore the lack of the connection.
|
|
*/
|
|
if (msg.whack_delete)
|
|
{
|
|
if (msg.whack_ca)
|
|
{
|
|
find_ca_info_by_name(msg.name, TRUE);
|
|
}
|
|
else
|
|
{
|
|
delete_connections_by_name(msg.name, !msg.whack_connection);
|
|
}
|
|
}
|
|
|
|
if (msg.whack_deletestate)
|
|
{
|
|
struct state *st = state_with_serialno(msg.whack_deletestateno);
|
|
|
|
if (st == NULL)
|
|
{
|
|
loglog(RC_UNKNOWN_NAME, "no state #%lu to delete"
|
|
, msg.whack_deletestateno);
|
|
}
|
|
else
|
|
{
|
|
delete_state(st);
|
|
}
|
|
}
|
|
|
|
if (msg.whack_crash)
|
|
{
|
|
delete_states_by_peer(&msg.whack_crash_peer);
|
|
}
|
|
|
|
if (msg.whack_connection)
|
|
{
|
|
add_connection(&msg);
|
|
}
|
|
|
|
if (msg.whack_ca && msg.cacert != NULL)
|
|
{
|
|
add_ca_info(&msg);
|
|
}
|
|
|
|
/* process "listen" before any operation that could require it */
|
|
if (msg.whack_listen)
|
|
{
|
|
close_peerlog(); /* close any open per-peer logs */
|
|
plog("listening for IKE messages");
|
|
listening = TRUE;
|
|
daily_log_reset();
|
|
reset_adns_restart_count();
|
|
set_myFQDN();
|
|
find_ifaces();
|
|
load_preshared_secrets(NULL_FD);
|
|
load_groups();
|
|
}
|
|
if (msg.whack_unlisten)
|
|
{
|
|
plog("no longer listening for IKE messages");
|
|
listening = FALSE;
|
|
}
|
|
|
|
if (msg.whack_reread & REREAD_SECRETS)
|
|
{
|
|
load_preshared_secrets(whackfd);
|
|
}
|
|
|
|
if (msg.whack_reread & REREAD_CACERTS)
|
|
{
|
|
load_authcerts("ca", CA_CERT_PATH, X509_CA);
|
|
}
|
|
|
|
if (msg.whack_reread & REREAD_AACERTS)
|
|
{
|
|
load_authcerts("aa", AA_CERT_PATH, X509_AA);
|
|
}
|
|
|
|
if (msg.whack_reread & REREAD_OCSPCERTS)
|
|
{
|
|
load_authcerts("ocsp", OCSP_CERT_PATH, X509_OCSP_SIGNER);
|
|
}
|
|
|
|
if (msg.whack_reread & REREAD_ACERTS)
|
|
{
|
|
ac_load_certs();
|
|
}
|
|
|
|
if (msg.whack_reread & REREAD_CRLS)
|
|
{
|
|
load_crls();
|
|
}
|
|
|
|
if (msg.whack_purgeocsp)
|
|
{
|
|
free_ocsp_fetch();
|
|
free_ocsp_cache();
|
|
}
|
|
|
|
if (msg.whack_leases)
|
|
{
|
|
list_leases(msg.name, msg.whack_lease_ip, msg.whack_lease_id);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_PUBKEYS)
|
|
{
|
|
list_public_keys(msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_CERTS)
|
|
{
|
|
cert_list(msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_CACERTS)
|
|
{
|
|
list_authcerts("CA", X509_CA, msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_AACERTS)
|
|
{
|
|
list_authcerts("AA", X509_AA, msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_OCSPCERTS)
|
|
{
|
|
list_authcerts("OCSP", X509_OCSP_SIGNER, msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_ACERTS)
|
|
{
|
|
ac_list_certs(msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_CAINFOS)
|
|
{
|
|
list_ca_infos(msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_CRLS)
|
|
{
|
|
list_crls(msg.whack_utc, strict_crl_policy);
|
|
list_crl_fetch_requests(msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_OCSP)
|
|
{
|
|
list_ocsp_cache(msg.whack_utc, strict_crl_policy);
|
|
list_ocsp_fetch_requests(msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_CARDS)
|
|
{
|
|
scx_list(msg.whack_utc);
|
|
}
|
|
|
|
if (msg.whack_list & LIST_ALGS)
|
|
{
|
|
ike_alg_list();
|
|
kernel_alg_list();
|
|
}
|
|
|
|
if (msg.whack_key)
|
|
{
|
|
/* add a public key */
|
|
key_add_request(&msg);
|
|
}
|
|
|
|
if (msg.whack_route)
|
|
{
|
|
if (!listening)
|
|
{
|
|
whack_log(RC_DEAF, "need --listen before --route");
|
|
}
|
|
if (msg.name == NULL)
|
|
{
|
|
whack_log(RC_UNKNOWN_NAME
|
|
, "whack --route requires a connection name");
|
|
}
|
|
else
|
|
{
|
|
connection_t *c = con_by_name(msg.name, TRUE);
|
|
|
|
if (c != NULL && c->ikev1)
|
|
{
|
|
set_cur_connection(c);
|
|
if (!oriented(*c))
|
|
{
|
|
whack_log(RC_ORIENT
|
|
, "we have no ipsecN interface for either end of this connection");
|
|
}
|
|
else if (c->policy & POLICY_GROUP)
|
|
{
|
|
route_group(c);
|
|
}
|
|
else if (!trap_connection(c))
|
|
{
|
|
whack_log(RC_ROUTE, "could not route");
|
|
}
|
|
reset_cur_connection();
|
|
}
|
|
}
|
|
}
|
|
|
|
if (msg.whack_unroute)
|
|
{
|
|
if (msg.name == NULL)
|
|
{
|
|
whack_log(RC_UNKNOWN_NAME
|
|
, "whack --unroute requires a connection name");
|
|
}
|
|
else
|
|
{
|
|
connection_t *c = con_by_name(msg.name, TRUE);
|
|
|
|
if (c != NULL && c->ikev1)
|
|
{
|
|
struct spd_route *sr;
|
|
int fail = 0;
|
|
|
|
set_cur_connection(c);
|
|
|
|
for (sr = &c->spd; sr != NULL; sr = sr->next)
|
|
{
|
|
if (sr->routing >= RT_ROUTED_TUNNEL)
|
|
{
|
|
fail++;
|
|
}
|
|
}
|
|
if (fail > 0)
|
|
{
|
|
whack_log(RC_RTBUSY, "cannot unroute: route busy");
|
|
}
|
|
else if (c->policy & POLICY_GROUP)
|
|
{
|
|
unroute_group(c);
|
|
}
|
|
else
|
|
{
|
|
unroute_connection(c);
|
|
}
|
|
reset_cur_connection();
|
|
}
|
|
}
|
|
}
|
|
|
|
if (msg.whack_initiate)
|
|
{
|
|
if (!listening)
|
|
{
|
|
whack_log(RC_DEAF, "need --listen before --initiate");
|
|
}
|
|
else if (msg.name == NULL)
|
|
{
|
|
whack_log(RC_UNKNOWN_NAME
|
|
, "whack --initiate requires a connection name");
|
|
}
|
|
else
|
|
{
|
|
initiate_connection(msg.name
|
|
, msg.whack_async? NULL_FD : dup_any(whackfd));
|
|
}
|
|
}
|
|
|
|
if (msg.whack_oppo_initiate)
|
|
{
|
|
if (!listening)
|
|
{
|
|
whack_log(RC_DEAF, "need --listen before opportunistic initiation");
|
|
}
|
|
else
|
|
{
|
|
initiate_opportunistic(&msg.oppo_my_client, &msg.oppo_peer_client, 0
|
|
, FALSE
|
|
, msg.whack_async? NULL_FD : dup_any(whackfd));
|
|
}
|
|
}
|
|
|
|
if (msg.whack_terminate)
|
|
{
|
|
if (msg.name == NULL)
|
|
{
|
|
whack_log(RC_UNKNOWN_NAME
|
|
, "whack --terminate requires a connection name");
|
|
}
|
|
else
|
|
{
|
|
terminate_connection(msg.name);
|
|
}
|
|
}
|
|
|
|
if (msg.whack_status)
|
|
{
|
|
show_status(msg.whack_statusall, msg.name);
|
|
}
|
|
|
|
if (msg.whack_shutdown)
|
|
{
|
|
plog("shutting down");
|
|
exit_pluto(0); /* delete lock and leave, with 0 status */
|
|
}
|
|
|
|
if (msg.whack_sc_op != SC_OP_NONE)
|
|
{
|
|
if (pkcs11_proxy)
|
|
{
|
|
scx_op_via_whack(msg.sc_data, msg.inbase, msg.outbase
|
|
, msg.whack_sc_op, msg.keyid, whackfd);
|
|
}
|
|
else
|
|
{
|
|
plog("pkcs11 access to smartcard not allowed (set pkcs11proxy=yes)");
|
|
}
|
|
}
|
|
|
|
whack_log_fd = NULL_FD;
|
|
close(whackfd);
|
|
}
|
|
|
|
/*
|
|
* Local Variables:
|
|
* c-basic-offset:4
|
|
* c-style: pluto
|
|
* End:
|
|
*/
|