denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'multi-vip'

Browse Source 
Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.
This commit is contained in:
Martin Willi
2012-08-31 12:55:56 +02:00
parent 868409139b 69e056a2c1
commit 1323dc1138
71 changed files with 2004 additions and 760 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/android/android_handler.c
+1 -1
View File
@@ -196,7 +196,7 @@ METHOD(enumerator_t, enumerate_dns, bool,
}
METHOD(attribute_handler_t, create_attribute_enumerator, enumerator_t *,
android_handler_t *this, identification_t *id, host_t *vip)
android_handler_t *this, identification_t *id, linked_list_t *vips)
{
enumerator_t *enumerator;
src/libcharon/plugins/android/android_service.c
+2 -2
View File
@@ -275,8 +275,8 @@ static job_requeue_t initiate(private_android_service_t *this)
600, 600, /* jitter, over 10min */
TRUE, FALSE, /* mobike, aggressive */
0, 0, /* DPD delay, timeout */
host_create_from_string("0.0.0.0", 0) /* virt */,
NULL, FALSE, NULL, NULL); /* pool, mediation */
FALSE, NULL, NULL); /* mediation */
peer_cfg->add_virtual_ip(peer_cfg, host_create_from_string("0.0.0.0", 0));
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
src/libcharon/plugins/dhcp/dhcp_provider.c
+18 -11
View File
@@ -84,7 +84,7 @@ METHOD(attribute_provider_t, acquire_address, host_t*,
private_dhcp_provider_t *this, char *pool,
identification_t *id, host_t *requested)
{
if (streq(pool, "dhcp"))
if (streq(pool, "dhcp") && requested->get_family(requested) == AF_INET)
{
dhcp_transaction_t *transaction, *old;
host_t *vip;
@@ -110,7 +110,7 @@ METHOD(attribute_provider_t, release_address, bool,
private_dhcp_provider_t *this, char *pool,
host_t *address, identification_t *id)
{
if (streq(pool, "dhcp"))
if (streq(pool, "dhcp") && address->get_family(address) == AF_INET)
{
dhcp_transaction_t *transaction;
@@ -129,18 +129,25 @@ METHOD(attribute_provider_t, release_address, bool,
}
METHOD(attribute_provider_t, create_attribute_enumerator, enumerator_t*,
private_dhcp_provider_t *this, char *pool, identification_t *id,
host_t *vip)
private_dhcp_provider_t *this, linked_list_t *pools, identification_t *id,
linked_list_t *vips)
{
dhcp_transaction_t *transaction;
dhcp_transaction_t *transaction = NULL;
enumerator_t *enumerator;
host_t *vip;
if (!vip)
{
return NULL;
}
this->mutex->lock(this->mutex);
transaction = this->transactions->get(this->transactions,
(void*)hash_id_host(id, vip));
enumerator = vips->create_enumerator(vips);
while (enumerator->enumerate(enumerator, &vip))
{
transaction = this->transactions->get(this->transactions,
(void*)hash_id_host(id, vip));
if (transaction)
{
break;
}
}
enumerator->destroy(enumerator);
if (!transaction)
{
this->mutex->unlock(this->mutex);
src/libcharon/plugins/eap_radius/eap_radius_accounting.c
+19 -10
View File
@@ -149,6 +149,7 @@ static bool send_message(private_eap_radius_accounting_t *this,
*/
static void add_ike_sa_parameters(radius_message_t *message, ike_sa_t *ike_sa)
{
enumerator_t *enumerator;
host_t *vip;
char buf[64];
chunk_t data;
@@ -157,17 +158,25 @@ static void add_ike_sa_parameters(radius_message_t *message, ike_sa_t *ike_sa)
message->add(message, RAT_USER_NAME, chunk_create(buf, strlen(buf)));
snprintf(buf, sizeof(buf), "%#H", ike_sa->get_other_host(ike_sa));
message->add(message, RAT_CALLING_STATION_ID, chunk_create(buf, strlen(buf)));
vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
if (vip && vip->get_family(vip) == AF_INET)
enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
while (enumerator->enumerate(enumerator, &vip))
{
message->add(message, RAT_FRAMED_IP_ADDRESS, vip->get_address(vip));
}
if (vip && vip->get_family(vip) == AF_INET6)
{
/* we currently assign /128 prefixes, only (reserved, length) */
data = chunk_from_chars(0, 128);
data = chunk_cata("cc", data, vip->get_address(vip));
message->add(message, RAT_FRAMED_IPV6_PREFIX, data);
switch (vip->get_family(vip))
{
case AF_INET:
message->add(message, RAT_FRAMED_IP_ADDRESS,
vip->get_address(vip));
break;
case AF_INET6:
/* we currently assign /128 prefixes, only (reserved, length) */
data = chunk_from_chars(0, 128);
data = chunk_cata("cc", data, vip->get_address(vip));
message->add(message, RAT_FRAMED_IPV6_PREFIX, data);
break;
default:
break;
}
}
}
src/libcharon/plugins/ha/ha_attribute.c
+6
View File
@@ -181,6 +181,12 @@ METHOD(attribute_provider_t, acquire_address, host_t*,
pool = get_pool(this, name);
if (pool)
{
if (pool->base->get_family(pool->base) !=
requested->get_family(requested))
{
this->mutex->unlock(this->mutex);
return NULL;
}
for (byte = 0; byte < pool->size / 8; byte++)
{
if (pool->mask[byte] != 0xFF)
src/libcharon/plugins/ha/ha_dispatcher.c
+13 -7
View File
@@ -344,10 +344,10 @@ static void process_ike_update(private_ha_dispatcher_t *this,
ike_sa->set_other_host(ike_sa, value.host->clone(value.host));
break;
case HA_LOCAL_VIP:
ike_sa->set_virtual_ip(ike_sa, TRUE, value.host);
ike_sa->add_virtual_ip(ike_sa, TRUE, value.host);
break;
case HA_REMOTE_VIP:
ike_sa->set_virtual_ip(ike_sa, FALSE, value.host);
ike_sa->add_virtual_ip(ike_sa, FALSE, value.host);
received_vip = TRUE;
break;
case HA_PEER_ADDR:
@@ -413,18 +413,24 @@ static void process_ike_update(private_ha_dispatcher_t *this,
}
if (received_vip)
{
enumerator_t *pools, *vips;
host_t *vip;
char *pool;
peer_cfg = ike_sa->get_peer_cfg(ike_sa);
vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
if (peer_cfg && vip)
if (peer_cfg)
{
pool = peer_cfg->get_pool(peer_cfg);
if (pool)
pools = peer_cfg->create_pool_enumerator(peer_cfg);
while (pools->enumerate(pools, &pool))
{
this->attr->reserve(this->attr, pool, vip);
vips = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
while (vips->enumerate(vips, &vip))
{
this->attr->reserve(this->attr, pool, vip);
}
vips->destroy(vips);
}
pools->destroy(pools);
}
}
if (ike_sa->get_version(ike_sa) == IKEV1)
src/libcharon/plugins/ha/ha_ike.c
+30 -22
View File
@@ -241,6 +241,34 @@ METHOD(listener_t, ike_state_change, bool,
return TRUE;
}
/**
* Send a virtual IP sync message for remote VIPs
*/
static void sync_vips(private_ha_ike_t *this, ike_sa_t *ike_sa)
{
ha_message_t *m = NULL;
enumerator_t *enumerator;
host_t *vip;
enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
while (enumerator->enumerate(enumerator, &vip))
{
if (!m)
{
m = ha_message_create(HA_IKE_UPDATE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
}
m->add_attribute(m, HA_REMOTE_VIP, vip);
}
enumerator->destroy(enumerator);
if (m)
{
this->socket->push(this->socket, m);
this->cache->cache(this->cache, ike_sa, m);
}
}
METHOD(listener_t, message_hook, bool,
private_ha_ike_t *this, ike_sa_t *ike_sa, message_t *message,
bool incoming, bool plain)
@@ -276,18 +304,7 @@ METHOD(listener_t, message_hook, bool,
{ /* After IKE_SA has been established, sync peers virtual IP.
* We cannot sync it in the state_change hook, it is installed later.
* TODO: where to sync local VIP? */
ha_message_t *m;
host_t *vip;
vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
if (vip)
{
m = ha_message_create(HA_IKE_UPDATE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
m->add_attribute(m, HA_REMOTE_VIP, vip);
this->socket->push(this->socket, m);
this->cache->cache(this->cache, ike_sa, m);
}
sync_vips(this, ike_sa);
}
}
if (!plain && ike_sa->get_version(ike_sa) == IKEV1)
@@ -296,7 +313,6 @@ METHOD(listener_t, message_hook, bool,
keymat_v1_t *keymat;
u_int32_t mid;
chunk_t iv;
host_t *vip;
mid = message->get_message_id(message);
if (mid == 0)
@@ -313,15 +329,7 @@ METHOD(listener_t, message_hook, bool,
}
if (!incoming && message->get_exchange_type(message) == TRANSACTION)
{
vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
if (vip)
{
m = ha_message_create(HA_IKE_UPDATE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
m->add_attribute(m, HA_REMOTE_VIP, vip);
this->socket->push(this->socket, m);
this->cache->cache(this->cache, ike_sa, m);
}
sync_vips(this, ike_sa);
}
}
if (plain && ike_sa->get_version(ike_sa) == IKEV1 &&
src/libcharon/plugins/ha/ha_tunnel.c
+1 -1
View File
@@ -209,7 +209,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
peer_cfg = peer_cfg_create("ha", IKEV2, ike_cfg, CERT_NEVER_SEND,
UNIQUE_KEEP, 0, 86400, 0, 7200, 3600, FALSE, FALSE, 30,
0, NULL, NULL, FALSE, NULL, NULL);
0, FALSE, NULL, NULL);
auth_cfg = auth_cfg_create();
auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
src/libcharon/plugins/load_tester/load_tester_config.c
+9 -2
View File
@@ -268,8 +268,15 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
FALSE, FALSE, /* mobike, aggressive mode */
this->dpd_delay, /* dpd_delay */
this->dpd_timeout, /* dpd_timeout */
this->vip ? this->vip->clone(this->vip) : NULL,
this->pool, FALSE, NULL, NULL);
FALSE, NULL, NULL);
if (this->vip)
{
peer_cfg->add_virtual_ip(peer_cfg, this->vip->clone(this->vip));
}
if (this->pool)
{
peer_cfg->add_pool(peer_cfg, this->pool);
}
if (num)
{ /* initiator */
generate_auth_cfg(this, this->initiator_auth, peer_cfg, TRUE, num);
src/libcharon/plugins/maemo/maemo_service.c
+2 -2
View File
@@ -335,8 +335,8 @@ static gboolean initiate_connection(private_maemo_service_t *this,
600, 600, /* jitter, over 10min */
TRUE, FALSE, /* mobike, aggressive */
0, 0, /* DPD delay, timeout */
host_create_from_string("0.0.0.0", 0) /* virt */,
NULL, FALSE, NULL, NULL); /* pool, mediation */
FALSE, NULL, NULL); /* mediation */
peer_cfg->add_virtual_ip(peer_cfg, host_create_from_string("0.0.0.0", 0));
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
src/libcharon/plugins/medcli/medcli_config.c
-3
View File
@@ -129,7 +129,6 @@ METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
this->rekey*5, this->rekey*3, /* jitter, overtime */
TRUE, FALSE, /* mobike, aggressive */
this->dpd, 0, /* DPD delay, timeout */
NULL, NULL, /* vip, pool */
TRUE, NULL, NULL); /* mediation, med by, peer id */
e->destroy(e);
@@ -167,7 +166,6 @@ METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
this->rekey*5, this->rekey*3, /* jitter, overtime */
TRUE, FALSE, /* mobike, aggressive */
this->dpd, 0, /* DPD delay, timeout */
NULL, NULL, /* vip, pool */
FALSE, med_cfg, /* mediation, med by */
identification_create_from_encoding(ID_KEY_ID, other));
@@ -243,7 +241,6 @@ METHOD(enumerator_t, peer_enumerator_enumerate, bool,
this->rekey*5, this->rekey*3, /* jitter, overtime */
TRUE, FALSE, /* mobike, aggressive */
this->dpd, 0, /* DPD delay, timeout */
NULL, NULL, /* vip, pool */
FALSE, NULL, NULL); /* mediation, med by, peer id */
auth = auth_cfg_create();
src/libcharon/plugins/medsrv/medsrv_config.c
-1
View File
@@ -94,7 +94,6 @@ METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*,
this->rekey*5, this->rekey*3, /* jitter, overtime */
TRUE, FALSE, /* mobike, aggressiv */
this->dpd, 0, /* DPD delay, timeout */
NULL, NULL, /* vip, pool */
TRUE, NULL, NULL); /* mediation, med by, peer id */
e->destroy(e);
src/libcharon/plugins/sql/sql_config.c
+17 -1
View File
@@ -333,6 +333,7 @@ static peer_cfg_t *build_peer_cfg(private_sql_config_t *this, enumerator_t *e,
mediation, mediated_by, p_type;
chunk_t l_data, r_data, p_data;
char *name, *virtual, *pool;
enumerator_t *enumerator;
while (e->enumerate(e,
&id, &name, &ike_cfg, &l_type, &l_data, &r_type, &r_data,
@@ -371,8 +372,23 @@ static peer_cfg_t *build_peer_cfg(private_sql_config_t *this, enumerator_t *e,
peer_cfg = peer_cfg_create(
name, IKEV2, ike, cert_policy, uniqueid,
keyingtries, rekeytime, reauthtime, jitter, overtime,
mobike, FALSE, dpd_delay, 0, vip, pool,
mobike, FALSE, dpd_delay, 0,
mediation, mediated_cfg, peer_id);
if (vip)
{
peer_cfg->add_virtual_ip(peer_cfg, vip);
}
if (pool)
{
/* attr-sql used comma separated pools, but we now completely
* support multiple pools directly. Support old SQL configs: */
enumerator = enumerator_create_token(pool, ",", " ");
while (enumerator->enumerate(enumerator, &pool))
{
peer_cfg->add_pool(peer_cfg, pool);
}
enumerator->destroy(enumerator);
}
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, auth_method);
auth->add(auth, AUTH_RULE_IDENTITY, local_id);
src/libcharon/plugins/stroke/Makefile.am
+1
View File
@@ -21,6 +21,7 @@ libstrongswan_stroke_la_SOURCES = \
stroke_cred.h stroke_cred.c \
stroke_ca.h stroke_ca.c \
stroke_attribute.h stroke_attribute.c \
stroke_handler.h stroke_handler.c \
stroke_list.h stroke_list.c
libstrongswan_stroke_la_LDFLAGS = -module -avoid-version
src/libcharon/plugins/stroke/stroke_attribute.c
+183 -43
View File
@@ -17,7 +17,6 @@
#include "stroke_attribute.h"
#include <daemon.h>
#include <attributes/mem_pool.h>
#include <utils/linked_list.h>
#include <threading/rwlock.h>
@@ -38,12 +37,37 @@ struct private_stroke_attribute_t {
*/
linked_list_t *pools;
/**
* List of connection specific attributes, as attributes_t
*/
linked_list_t *attrs;
/**
* rwlock to lock access to pools
*/
rwlock_t *lock;
};
/**
* Attributes assigned to a connection
*/
typedef struct {
/** name of the connection */
char *name;
/** list of DNS attributes, as host_t */
linked_list_t *dns;
} attributes_t;
/**
* Destroy an attributes_t entry
*/
static void attributes_destroy(attributes_t *this)
{
this->dns->destroy_offset(this->dns, offsetof(host_t, destroy));
free(this->name);
free(this);
}
/**
* find a pool by name
*/
@@ -66,11 +90,12 @@ static mem_pool_t *find_pool(private_stroke_attribute_t *this, char *name)
}
METHOD(attribute_provider_t, acquire_address, host_t*,
private_stroke_attribute_t *this, char *name, identification_t *id,
host_t *requested)
private_stroke_attribute_t *this, char *name, identification_t *id,
host_t *requested)
{
mem_pool_t *pool;
host_t *addr = NULL;
this->lock->read_lock(this->lock);
pool = find_pool(this, name);
if (pool)
@@ -82,11 +107,12 @@ METHOD(attribute_provider_t, acquire_address, host_t*,
}
METHOD(attribute_provider_t, release_address, bool,
private_stroke_attribute_t *this, char *name, host_t *address,
identification_t *id)
private_stroke_attribute_t *this, char *name, host_t *address,
identification_t *id)
{
mem_pool_t *pool;
bool found = FALSE;
this->lock->read_lock(this->lock);
pool = find_pool(this, name);
if (pool)
@@ -97,56 +123,162 @@ METHOD(attribute_provider_t, release_address, bool,
return found;
}
METHOD(stroke_attribute_t, add_pool, void,
private_stroke_attribute_t *this, stroke_msg_t *msg)
/**
* Filter function to convert host to DNS configuration attributes
*/
static bool attr_filter(void *lock, host_t **in,
configuration_attribute_type_t *type,
void *dummy, chunk_t *data)
{
if (msg->add_conn.other.sourceip_mask)
host_t *host = *in;
switch (host->get_family(host))
{
mem_pool_t *pool;
host_t *base = NULL;
u_int32_t bits = 0;
/* if %config, add an empty pool, otherwise */
if (msg->add_conn.other.sourceip)
{
DBG1(DBG_CFG, "adding virtual IP address pool '%s': %s/%d",
msg->add_conn.name, msg->add_conn.other.sourceip,
msg->add_conn.other.sourceip_mask);
base = host_create_from_string(msg->add_conn.other.sourceip, 0);
if (!base)
{
DBG1(DBG_CFG, "virtual IP address invalid, discarded");
return;
}
bits = msg->add_conn.other.sourceip_mask;
}
pool = mem_pool_create(msg->add_conn.name, base, bits);
DESTROY_IF(base);
this->lock->write_lock(this->lock);
this->pools->insert_last(this->pools, pool);
this->lock->unlock(this->lock);
case AF_INET:
*type = INTERNAL_IP4_DNS;
break;
case AF_INET6:
*type = INTERNAL_IP6_DNS;
break;
default:
return FALSE;
}
*data = host->get_address(host);
return TRUE;
}
METHOD(stroke_attribute_t, del_pool, void,
private_stroke_attribute_t *this, stroke_msg_t *msg)
METHOD(attribute_provider_t, create_attribute_enumerator, enumerator_t*,
private_stroke_attribute_t *this, linked_list_t *pools,
identification_t *id, linked_list_t *vips)
{
ike_sa_t *ike_sa;
peer_cfg_t *peer_cfg;
enumerator_t *enumerator;
attributes_t *attr;
ike_sa = charon->bus->get_sa(charon->bus);
if (ike_sa)
{
peer_cfg = ike_sa->get_peer_cfg(ike_sa);
this->lock->read_lock(this->lock);
enumerator = this->attrs->create_enumerator(this->attrs);
while (enumerator->enumerate(enumerator, &attr))
{
if (streq(attr->name, peer_cfg->get_name(peer_cfg)))
{
enumerator->destroy(enumerator);
return enumerator_create_filter(
attr->dns->create_enumerator(attr->dns),
(void*)attr_filter, this->lock,
(void*)this->lock->unlock);
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
}
return enumerator_create_empty();
}
METHOD(stroke_attribute_t, add_pool, void,
private_stroke_attribute_t *this, mem_pool_t *pool)
{
enumerator_t *enumerator;
mem_pool_t *pool;
mem_pool_t *current;
host_t *base;
int size;
base = pool->get_base(pool);
size = pool->get_size(pool);
this->lock->write_lock(this->lock);
enumerator = this->pools->create_enumerator(this->pools);
while (enumerator->enumerate(enumerator, &pool))
while (enumerator->enumerate(enumerator, &current))
{
if (streq(msg->del_conn.name, pool->get_name(pool)))
if (base && current->get_base(current) &&
base->ip_equals(base, current->get_base(current)) &&
size == current->get_size(current))
{
this->pools->remove_at(this->pools, enumerator);
pool->destroy(pool);
pool = NULL;
DBG1(DBG_CFG, "reusing virtual IP address pool %H/%d", base, size);
break;
}
}
enumerator->destroy(enumerator);
if (pool)
{
if (base)
{
DBG1(DBG_CFG, "adding virtual IP address pool %H/%d", base, size);
}
this->pools->insert_last(this->pools, pool);
}
this->lock->unlock(this->lock);
}
METHOD(stroke_attribute_t, add_dns, void,
private_stroke_attribute_t *this, stroke_msg_t *msg)
{
if (msg->add_conn.other.dns)
{
enumerator_t *enumerator;
attributes_t *attr = NULL;
host_t *host;
char *token;
enumerator = enumerator_create_token(msg->add_conn.other.dns, ",", " ");
while (enumerator->enumerate(enumerator, &token))
{
host = host_create_from_string(token, 0);
if (host)
{
if (!attr)
{
INIT(attr,
.name = strdup(msg->add_conn.name),
.dns = linked_list_create(),
);
}
attr->dns->insert_last(attr->dns, host);
}
else
{
DBG1(DBG_CFG, "ignoring invalid DNS address '%s'", token);
}
}
enumerator->destroy(enumerator);
if (attr)
{
this->lock->write_lock(this->lock);
this->attrs->insert_last(this->attrs, attr);
this->lock->unlock(this->lock);
}
}
}
METHOD(stroke_attribute_t, del_dns, void,
private_stroke_attribute_t *this, stroke_msg_t *msg)
{
enumerator_t *enumerator;
attributes_t *attr;
this->lock->write_lock(this->lock);
enumerator = this->attrs->create_enumerator(this->attrs);
while (enumerator->enumerate(enumerator, &attr))
{
if (streq(msg->del_conn.name, attr->name))
{
this->attrs->remove_at(this->attrs, enumerator);
attributes_destroy(attr);
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
}
@@ -158,6 +290,11 @@ static bool pool_filter(void *lock, mem_pool_t **poolp, const char **name,
void *d3, u_int *offline)
{
mem_pool_t *pool = *poolp;
if (pool->get_size(pool) == 0)
{
return FALSE;
}
*name = pool->get_name(pool);
*size = pool->get_size(pool);
*online = pool->get_online(pool);
@@ -166,7 +303,7 @@ static bool pool_filter(void *lock, mem_pool_t **poolp, const char **name,
}
METHOD(stroke_attribute_t, create_pool_enumerator, enumerator_t*,
private_stroke_attribute_t *this)
private_stroke_attribute_t *this)
{
this->lock->read_lock(this->lock);
return enumerator_create_filter(this->pools->create_enumerator(this->pools),
@@ -175,7 +312,7 @@ METHOD(stroke_attribute_t, create_pool_enumerator, enumerator_t*,
}
METHOD(stroke_attribute_t, create_lease_enumerator, enumerator_t*,
private_stroke_attribute_t *this, char *name)
private_stroke_attribute_t *this, char *name)
{
mem_pool_t *pool;
this->lock->read_lock(this->lock);
@@ -190,10 +327,11 @@ METHOD(stroke_attribute_t, create_lease_enumerator, enumerator_t*,
}
METHOD(stroke_attribute_t, destroy, void,
private_stroke_attribute_t *this)
private_stroke_attribute_t *this)
{
this->lock->destroy(this->lock);
this->pools->destroy_offset(this->pools, offsetof(mem_pool_t, destroy));
this->attrs->destroy_function(this->attrs, (void*)attributes_destroy);
free(this);
}
@@ -209,15 +347,17 @@ stroke_attribute_t *stroke_attribute_create()
.provider = {
.acquire_address = _acquire_address,
.release_address = _release_address,
.create_attribute_enumerator = enumerator_create_empty,
.create_attribute_enumerator = _create_attribute_enumerator,
},
.add_pool = _add_pool,
.del_pool = _del_pool,
.add_dns = _add_dns,
.del_dns = _del_dns,
.create_pool_enumerator = _create_pool_enumerator,
.create_lease_enumerator = _create_lease_enumerator,
.destroy = _destroy,
},
.pools = linked_list_create(),
.attrs = linked_list_create(),
.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
);
src/libcharon/plugins/stroke/stroke_attribute.h
+17 -6
View File
@@ -23,6 +23,7 @@
#include <stroke_msg.h>
#include <attributes/attribute_provider.h>
#include <attributes/mem_pool.h>
typedef struct stroke_attribute_t stroke_attribute_t;
@@ -37,18 +38,28 @@ struct stroke_attribute_t {
attribute_provider_t provider;
/**
* Add a virtual IP address pool.
* Add a memory pool to this virtual IP backend.
*
* @param msg stroke message
* The pool gets owned by the provider, or destroyed if such a pool
* is already registered.
*
* @param pool virtual IP pool to add
*/
void (*add_pool)(stroke_attribute_t *this, stroke_msg_t *msg);
void (*add_pool)(stroke_attribute_t *this, mem_pool_t *pool);
/**
* Remove a virtual IP address pool.
* Add connection specific DNS servers.
*
* @param msg stroke message
* @param msg stroke add message
*/
void (*del_pool)(stroke_attribute_t *this, stroke_msg_t *msg);
void (*add_dns)(stroke_attribute_t *this, stroke_msg_t *msg);
/**
* Remove connection specific DNS servers.
*
* @param msg stroke del message
*/
void (*del_dns)(stroke_attribute_t *this, stroke_msg_t *msg);
/**
* Create an enumerator over installed pools.
src/libcharon/plugins/stroke/stroke_config.c
+126 -47
View File
@@ -52,6 +52,11 @@ struct private_stroke_config_t {
* credentials
*/
stroke_cred_t *cred;
/**
* Virtual IP pool / DNS backend
*/
stroke_attribute_t *attributes;
};
METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*,
@@ -618,7 +623,6 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
{
identification_t *peer_id = NULL;
peer_cfg_t *mediated_by = NULL;
host_t *vip = NULL;
unique_policy_t unique;
u_int32_t rekey = 0, reauth = 0, over, jitter;
peer_cfg_t *peer_cfg;
@@ -677,49 +681,6 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
{
rekey = msg->add_conn.rekey.ike_lifetime - over;
}
if (msg->add_conn.me.sourceip_mask)
{
if (msg->add_conn.me.sourceip)
{
vip = host_create_from_string(msg->add_conn.me.sourceip, 0);
}
if (!vip)
{ /* if it is set to something like %poolname, request an address */
if (msg->add_conn.me.subnets)
{ /* use the same family as in local subnet, if any */
if (strchr(msg->add_conn.me.subnets, '.'))
{
vip = host_create_any(AF_INET);
}
else
{
vip = host_create_any(AF_INET6);
}
}
else if (msg->add_conn.other.subnets)
{ /* use the same family as in remote subnet, if any */
if (strchr(msg->add_conn.other.subnets, '.'))
{
vip = host_create_any(AF_INET);
}
else
{
vip = host_create_any(AF_INET6);
}
}
else
{
if (strchr(ike_cfg->get_my_addr(ike_cfg, NULL), ':'))
{
vip = host_create_any(AF_INET6);
}
else
{
vip = host_create_any(AF_INET);
}
}
}
}
switch (msg->add_conn.unique)
{
case 1: /* yes */
@@ -747,10 +708,126 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
msg->add_conn.rekey.tries, rekey, reauth, jitter, over,
msg->add_conn.mobike, msg->add_conn.aggressive,
msg->add_conn.dpd.delay, msg->add_conn.dpd.timeout,
vip, msg->add_conn.other.sourceip_mask ?
msg->add_conn.name : msg->add_conn.other.sourceip,
msg->add_conn.ikeme.mediation, mediated_by, peer_id);
if (msg->add_conn.other.sourceip)
{
enumerator_t *enumerator;
char *token;
enumerator = enumerator_create_token(msg->add_conn.other.sourceip,
",", " ");
while (enumerator->enumerate(enumerator, &token))
{
if (streq(token, "%modeconfig") || streq(token, "%modecfg") ||
streq(token, "%config") || streq(token, "%cfg") ||
streq(token, "%config4") || streq(token, "%config6"))
{
/* empty pool, uses connection name */
this->attributes->add_pool(this->attributes,
mem_pool_create(msg->add_conn.name, NULL, 0));
peer_cfg->add_pool(peer_cfg, msg->add_conn.name);
}
else if (*token == '%')
{
/* external named pool */
peer_cfg->add_pool(peer_cfg, token + 1);
}
else
{
/* in-memory pool, named using CIDR notation */
host_t *base;
int bits;
base = host_create_from_subnet(token, &bits);
if (base)
{
this->attributes->add_pool(this->attributes,
mem_pool_create(token, base, bits));
peer_cfg->add_pool(peer_cfg, token);
base->destroy(base);
}
else
{
DBG1(DBG_CFG, "IP pool %s invalid, ignored", token);
}
}
}
enumerator->destroy(enumerator);
}
if (msg->add_conn.me.sourceip)
{
enumerator_t *enumerator;
char *token;
enumerator = enumerator_create_token(msg->add_conn.me.sourceip, ",", " ");
while (enumerator->enumerate(enumerator, &token))
{
host_t *vip = NULL;
if (streq(token, "%modeconfig") || streq(token, "%modecfg") ||
streq(token, "%config") || streq(token, "%cfg"))
{ /* try to deduce an address family */
if (msg->add_conn.me.subnets)
{ /* use the same family as in local subnet, if any */
if (strchr(msg->add_conn.me.subnets, '.'))
{
vip = host_create_any(AF_INET);
}
else
{
vip = host_create_any(AF_INET6);
}
}
else if (msg->add_conn.other.subnets)
{ /* use the same family as in remote subnet, if any */
if (strchr(msg->add_conn.other.subnets, '.'))
{
vip = host_create_any(AF_INET);
}
else
{
vip = host_create_any(AF_INET6);
}
}
else
{
if (strchr(ike_cfg->get_my_addr(ike_cfg, NULL), ':'))
{
vip = host_create_any(AF_INET6);
}
else
{
vip = host_create_any(AF_INET);
}
}
}
else if (streq(token, "%config4"))
{
vip = host_create_any(AF_INET);
}
else if (streq(token, "%config6"))
{
vip = host_create_any(AF_INET6);
}
else
{
vip = host_create_from_string(token, 0);
if (vip)
{
DBG1(DBG_CFG, "ignored invalid subnet token: %s", token);
}
}
if (vip)
{
peer_cfg->add_virtual_ip(peer_cfg, vip);
}
}
enumerator->destroy(enumerator);
}
/* build leftauth= */
auth_cfg = build_auth_cfg(this, msg, TRUE, TRUE);
if (auth_cfg)
@@ -1209,7 +1286,8 @@ METHOD(stroke_config_t, destroy, void,
/*
* see header file
*/
stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred)
stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred,
stroke_attribute_t *attributes)
{
private_stroke_config_t *this;
@@ -1229,6 +1307,7 @@ stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred)
.mutex = mutex_create(MUTEX_TYPE_RECURSIVE),
.ca = ca,
.cred = cred,
.attributes = attributes,
);
return &this->public;
src/libcharon/plugins/stroke/stroke_config.h
+3 -1
View File
@@ -26,6 +26,7 @@
#include <stroke_msg.h>
#include "stroke_ca.h"
#include "stroke_cred.h"
#include "stroke_attribute.h"
typedef struct stroke_config_t stroke_config_t;
@@ -71,6 +72,7 @@ struct stroke_config_t {
/**
* Create a stroke_config instance.
*/
stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred);
stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred,
stroke_attribute_t *attributes);
#endif /** STROKE_CONFIG_H_ @}*/
src/libcharon/plugins/stroke/stroke_control.c
+34 -27
View File
@@ -407,10 +407,10 @@ METHOD(stroke_control_t, rekey, void,
METHOD(stroke_control_t, terminate_srcip, void,
private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
{
enumerator_t *enumerator;
enumerator_t *enumerator, *vips;
ike_sa_t *ike_sa;
host_t *start = NULL, *end = NULL, *vip;
chunk_t chunk_start, chunk_end = chunk_empty, chunk_vip;
chunk_t chunk_start, chunk_end = chunk_empty, chunk;
if (msg->terminate_srcip.start)
{
@@ -438,33 +438,40 @@ METHOD(stroke_control_t, terminate_srcip, void,
charon->controller, TRUE);
while (enumerator->enumerate(enumerator, &ike_sa))
{
vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
if (!vip)
{
continue;
}
if (!end)
{
if (!vip->ip_equals(vip, start))
{
continue;
}
}
else
{
chunk_vip = vip->get_address(vip);
if (chunk_vip.len != chunk_start.len ||
chunk_vip.len != chunk_end.len ||
memcmp(chunk_vip.ptr, chunk_start.ptr, chunk_vip.len) < 0 ||
memcmp(chunk_vip.ptr, chunk_end.ptr, chunk_vip.len) > 0)
{
continue;
}
}
bool match = FALSE;
/* schedule delete asynchronously */
lib->processor->queue_job(lib->processor, (job_t*)
vips = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
while (vips->enumerate(vips, &vip))
{
if (!end)
{
if (vip->ip_equals(vip, start))
{
match = TRUE;
break;
}
}
else
{
chunk = vip->get_address(vip);
if (chunk.len == chunk_start.len &&
chunk.len == chunk_end.len &&
memcmp(chunk.ptr, chunk_start.ptr, chunk.len) >= 0 &&
memcmp(chunk.ptr, chunk_end.ptr, chunk.len) <= 0)
{
match = TRUE;
break;
}
}
}
vips->destroy(vips);
if (match)
{
/* schedule delete asynchronously */
lib->processor->queue_job(lib->processor, (job_t*)
delete_ike_sa_job_create(ike_sa->get_id(ike_sa), TRUE));
}
}
enumerator->destroy(enumerator);
start->destroy(start);
src/libcharon/plugins/stroke/stroke_handler.c
+231
View File
@@ -0,0 +1,231 @@
/*
* Copyright (C) 2012 Martin Willi
* Copyright (C) 2012 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "stroke_handler.h"
#include <daemon.h>
#include <utils/linked_list.h>
#include <threading/rwlock.h>
typedef struct private_stroke_handler_t private_stroke_handler_t;
/**
* Private data of an stroke_handler_t object.
*/
struct private_stroke_handler_t {
/**
* Public stroke_handler_t interface.
*/
stroke_handler_t public;
/**
* List of connection specific attributes, as attributes_t
*/
linked_list_t *attrs;
/**
* rwlock to lock access to pools
*/
rwlock_t *lock;
};
/**
* Attributes assigned to a connection
*/
typedef struct {
/** name of the connection */
char *name;
/** list of DNS attributes, as host_t */
linked_list_t *dns;
} attributes_t;
/**
* Destroy an attributes_t entry
*/
static void attributes_destroy(attributes_t *this)
{
this->dns->destroy_offset(this->dns, offsetof(host_t, destroy));
free(this->name);
free(this);
}
/**
* Filter function to convert host to DNS configuration attributes
*/
static bool attr_filter(void *lock, host_t **in,
configuration_attribute_type_t *type,
void *dummy, chunk_t *data)
{
host_t *host = *in;
switch (host->get_family(host))
{
case AF_INET:
*type = INTERNAL_IP4_DNS;
break;
case AF_INET6:
*type = INTERNAL_IP6_DNS;
break;
default:
return FALSE;
}
if (host->is_anyaddr(host))
{
*data = chunk_empty;
}
else
{
*data = host->get_address(host);
}
return TRUE;
}
METHOD(attribute_handler_t, create_attribute_enumerator, enumerator_t*,
private_stroke_handler_t *this, identification_t *server,
linked_list_t *vips)
{
ike_sa_t *ike_sa;
peer_cfg_t *peer_cfg;
enumerator_t *enumerator;
attributes_t *attr;
ike_sa = charon->bus->get_sa(charon->bus);
if (ike_sa)
{
peer_cfg = ike_sa->get_peer_cfg(ike_sa);
this->lock->read_lock(this->lock);
enumerator = this->attrs->create_enumerator(this->attrs);
while (enumerator->enumerate(enumerator, &attr))
{
if (streq(attr->name, peer_cfg->get_name(peer_cfg)))
{
enumerator->destroy(enumerator);
return enumerator_create_filter(
attr->dns->create_enumerator(attr->dns),
(void*)attr_filter, this->lock,
(void*)this->lock->unlock);
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
}
return enumerator_create_empty();
}
METHOD(stroke_handler_t, add_attributes, void,
private_stroke_handler_t *this, stroke_msg_t *msg)
{
if (msg->add_conn.me.dns)
{
enumerator_t *enumerator;
attributes_t *attr = NULL;
host_t *host;
char *token;
enumerator = enumerator_create_token(msg->add_conn.me.dns, ",", " ");
while (enumerator->enumerate(enumerator, &token))
{
if (streq(token, "%config") || streq(token, "%config4"))
{
host = host_create_any(AF_INET);
}
else if (streq(token, "%config6"))
{
host = host_create_any(AF_INET6);
}
else
{
host = host_create_from_string(token, 0);
}
if (host)
{
if (!attr)
{
INIT(attr,
.name = strdup(msg->add_conn.name),
.dns = linked_list_create(),
);
}
attr->dns->insert_last(attr->dns, host);
}
else
{
DBG1(DBG_CFG, "ignoring invalid DNS address '%s'", token);
}
}
enumerator->destroy(enumerator);
if (attr)
{
this->lock->write_lock(this->lock);
this->attrs->insert_last(this->attrs, attr);
this->lock->unlock(this->lock);
}
}
}
METHOD(stroke_handler_t, del_attributes, void,
private_stroke_handler_t *this, stroke_msg_t *msg)
{
enumerator_t *enumerator;
attributes_t *attr;
this->lock->write_lock(this->lock);
enumerator = this->attrs->create_enumerator(this->attrs);
while (enumerator->enumerate(enumerator, &attr))
{
if (streq(msg->del_conn.name, attr->name))
{
this->attrs->remove_at(this->attrs, enumerator);
attributes_destroy(attr);
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
}
METHOD(stroke_handler_t, destroy, void,
private_stroke_handler_t *this)
{
this->lock->destroy(this->lock);
this->attrs->destroy_function(this->attrs, (void*)attributes_destroy);
free(this);
}
/**
* See header
*/
stroke_handler_t *stroke_handler_create()
{
private_stroke_handler_t *this;
INIT(this,
.public = {
.handler = {
.handle = (void*)return_false,
.release = (void*)return_false,
.create_attribute_enumerator = _create_attribute_enumerator,
},
.add_attributes = _add_attributes,
.del_attributes = _del_attributes,
.destroy = _destroy,
},
.attrs = linked_list_create(),
.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
);
return &this->public;
}
src/libcharon/plugins/stroke/stroke_handler.h
+64
View File
@@ -0,0 +1,64 @@
/*
* Copyright (C) 2012 Martin Willi
* Copyright (C) 2012 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup stroke_handler stroke_handler
* @{ @ingroup stroke
*/
#ifndef STROKE_HANDLER_H_
#define STROKE_HANDLER_H_
#include <stroke_msg.h>
#include <attributes/attribute_handler.h>
typedef struct stroke_handler_t stroke_handler_t;
/**
* Handler requesting DNS attributes as defined with leftdns option.
*/
struct stroke_handler_t {
/**
* Implements the attribute_handler_t interface
*/
attribute_handler_t handler;
/**
* Add connection specific configuration attributes.
*
* @param msg stroke message
*/
void (*add_attributes)(stroke_handler_t *this, stroke_msg_t *msg);
/**
* Remove connection specific configuration attributes.
*
* @param msg stroke message
*/
void (*del_attributes)(stroke_handler_t *this, stroke_msg_t *msg);
/**
* Destroy a stroke_handler_t.
*/
void (*destroy)(stroke_handler_t *this);
};
/**
* Create a stroke_handler instance.
*/
stroke_handler_t *stroke_handler_create();
#endif /** STROKE_HANDLER_H_ @}*/
src/libcharon/plugins/stroke/stroke_socket.c
+17 -3
View File
@@ -37,6 +37,7 @@
#include "stroke_cred.h"
#include "stroke_ca.h"
#include "stroke_attribute.h"
#include "stroke_handler.h"
#include "stroke_list.h"
/**
@@ -98,6 +99,11 @@ struct private_stroke_socket_t {
*/
stroke_attribute_t *attribute;
/**
* attribute handler (requests only)
*/
stroke_handler_t *handler;
/**
* controller to control daemon
*/
@@ -171,6 +177,7 @@ static void pop_end(stroke_msg_t *msg, const char* label, stroke_end_t *end)
pop_string(msg, &end->address);
pop_string(msg, &end->subnets);
pop_string(msg, &end->sourceip);
pop_string(msg, &end->dns);
pop_string(msg, &end->auth);
pop_string(msg, &end->auth2);
pop_string(msg, &end->id);
@@ -188,6 +195,7 @@ static void pop_end(stroke_msg_t *msg, const char* label, stroke_end_t *end)
DBG2(DBG_CFG, " %s=%s", label, end->address);
DBG2(DBG_CFG, " %ssubnet=%s", label, end->subnets);
DBG2(DBG_CFG, " %ssourceip=%s", label, end->sourceip);
DBG2(DBG_CFG, " %sdns=%s", label, end->dns);
DBG2(DBG_CFG, " %sauth=%s", label, end->auth);
DBG2(DBG_CFG, " %sauth2=%s", label, end->auth2);
DBG2(DBG_CFG, " %sid=%s", label, end->id);
@@ -235,7 +243,8 @@ static void stroke_add_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
DBG2(DBG_CFG, " keyexchange=ikev%u", msg->add_conn.version);
this->config->add(this->config, msg);
this->attribute->add_pool(this->attribute, msg);
this->attribute->add_dns(this->attribute, msg);
this->handler->add_attributes(this->handler, msg);
}
/**
@@ -247,7 +256,8 @@ static void stroke_del_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
DBG1(DBG_CFG, "received stroke: delete connection '%s'", msg->del_conn.name);
this->config->del(this->config, msg);
this->attribute->del_pool(this->attribute, msg);
this->attribute->del_dns(this->attribute, msg);
this->handler->del_attributes(this->handler, msg);
}
/**
@@ -787,10 +797,12 @@ METHOD(stroke_socket_t, destroy, void,
lib->credmgr->remove_set(lib->credmgr, &this->cred->set);
charon->backends->remove_backend(charon->backends, &this->config->backend);
hydra->attributes->remove_provider(hydra->attributes, &this->attribute->provider);
hydra->attributes->remove_handler(hydra->attributes, &this->handler->handler);
this->cred->destroy(this->cred);
this->ca->destroy(this->ca);
this->config->destroy(this->config);
this->attribute->destroy(this->attribute);
this->handler->destroy(this->handler);
this->control->destroy(this->control);
this->list->destroy(this->list);
free(this);
@@ -817,8 +829,9 @@ stroke_socket_t *stroke_socket_create()
this->cred = stroke_cred_create();
this->attribute = stroke_attribute_create();
this->handler = stroke_handler_create();
this->ca = stroke_ca_create(this->cred);
this->config = stroke_config_create(this->ca, this->cred);
this->config = stroke_config_create(this->ca, this->cred, this->attribute);
this->control = stroke_control_create();
this->list = stroke_list_create(this->attribute);
@@ -833,6 +846,7 @@ stroke_socket_t *stroke_socket_create()
lib->credmgr->add_set(lib->credmgr, &this->cred->set);
charon->backends->add_backend(charon->backends, &this->config->backend);
hydra->attributes->add_provider(hydra->attributes, &this->attribute->provider);
hydra->attributes->add_handler(hydra->attributes, &this->handler->handler);
lib->processor->queue_job(lib->processor,
(job_t*)callback_job_create_with_prio((callback_job_cb_t)receive, this,
src/libcharon/plugins/uci/uci_config.c
-1
View File
@@ -178,7 +178,6 @@ METHOD(enumerator_t, peer_enumerator_enumerate, bool,
1800, 900, /* jitter, overtime */
TRUE, FALSE, /* mobike, aggressive */
60, 0, /* DPD delay, timeout */
NULL, NULL, /* vip, pool */
FALSE, NULL, NULL); /* mediation, med by, peer id */
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
src/libcharon/plugins/updown/Makefile.am
+1
View File
@@ -12,6 +12,7 @@ endif
libstrongswan_updown_la_SOURCES = \
updown_plugin.h updown_plugin.c \
updown_handler.h updown_handler.c \
updown_listener.h updown_listener.c
libstrongswan_updown_la_LDFLAGS = -module -avoid-version
src/libcharon/plugins/updown/updown_handler.c
+243
View File
@@ -0,0 +1,243 @@
/*
* Copyright (C) 2012 Martin Willi
* Copyright (C) 2012 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "updown_handler.h"
#include <daemon.h>
#include <utils/linked_list.h>
#include <threading/rwlock.h>
typedef struct private_updown_handler_t private_updown_handler_t;
/**
* Private data of an updown_handler_t object.
*/
struct private_updown_handler_t {
/**
* Public updown_handler_t interface.
*/
updown_handler_t public;
/**
* List of connection specific attributes, as attributes_t
*/
linked_list_t *attrs;
/**
* rwlock to lock access to pools
*/
rwlock_t *lock;
};
/**
* Attributes assigned to an IKE_SA
*/
typedef struct {
/** unique IKE_SA identifier */
u_int id;
/** list of DNS attributes, as host_t */
linked_list_t *dns;
} attributes_t;
/**
* Destroy an attributes_t entry
*/
static void attributes_destroy(attributes_t *this)
{
this->dns->destroy_offset(this->dns, offsetof(host_t, destroy));
free(this);
}
METHOD(attribute_handler_t, handle, bool,
private_updown_handler_t *this, identification_t *server,
configuration_attribute_type_t type, chunk_t data)
{
attributes_t *current, *attr = NULL;
enumerator_t *enumerator;
ike_sa_t *ike_sa;
host_t *host;
ike_sa = charon->bus->get_sa(charon->bus);
if (!ike_sa)
{
return FALSE;
}
switch (type)
{
case INTERNAL_IP4_DNS:
host = host_create_from_chunk(AF_INET, data, 0);
break;
case INTERNAL_IP6_DNS:
host = host_create_from_chunk(AF_INET6, data, 0);
break;
default:
return FALSE;
}
if (!host)
{
return FALSE;
}
this->lock->write_lock(this->lock);
enumerator = this->attrs->create_enumerator(this->attrs);
while (enumerator->enumerate(enumerator, &current))
{
if (current->id == ike_sa->get_unique_id(ike_sa))
{
attr = current;
}
}
enumerator->destroy(enumerator);
if (!attr)
{
INIT(attr,
.id = ike_sa->get_unique_id(ike_sa),
.dns = linked_list_create(),
);
this->attrs->insert_last(this->attrs, attr);
}
attr->dns->insert_last(attr->dns, host);
this->lock->unlock(this->lock);
return TRUE;
}
METHOD(attribute_handler_t, release, void,
private_updown_handler_t *this, identification_t *server,
configuration_attribute_type_t type, chunk_t data)
{
attributes_t *attr;
enumerator_t *enumerator, *servers;
ike_sa_t *ike_sa;
host_t *host;
bool found = FALSE;
int family;
switch (type)
{
case INTERNAL_IP4_DNS:
family = AF_INET;
break;
case INTERNAL_IP6_DNS:
family = AF_INET6;
break;
default:
return;
}
ike_sa = charon->bus->get_sa(charon->bus);
if (ike_sa)
{
this->lock->write_lock(this->lock);
enumerator = this->attrs->create_enumerator(this->attrs);
while (enumerator->enumerate(enumerator, &attr))
{
if (attr->id == ike_sa->get_unique_id(ike_sa))
{
servers = attr->dns->create_enumerator(attr->dns);
while (servers->enumerate(servers, &host))
{
if (host->get_family(host) == family &&
chunk_equals(data, host->get_address(host)))
{
attr->dns->remove_at(attr->dns, servers);
host->destroy(host);
found = TRUE;
break;
}
}
servers->destroy(servers);
if (attr->dns->get_count(attr->dns) == 0)
{
this->attrs->remove_at(this->attrs, enumerator);
attributes_destroy(attr);
break;
}
}
if (found)
{
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
}
}
METHOD(updown_handler_t, create_dns_enumerator, enumerator_t*,
private_updown_handler_t *this, u_int id)
{
attributes_t *attr;
enumerator_t *enumerator;
ike_sa_t *ike_sa;
ike_sa = charon->bus->get_sa(charon->bus);
if (!ike_sa)
{
return FALSE;
}
this->lock->read_lock(this->lock);
enumerator = this->attrs->create_enumerator(this->attrs);
while (enumerator->enumerate(enumerator, &attr))
{
if (attr->id == ike_sa->get_unique_id(ike_sa))
{
enumerator->destroy(enumerator);
return enumerator_create_cleaner(
attr->dns->create_enumerator(attr->dns),
(void*)this->lock->unlock, this->lock);
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
return enumerator_create_empty();
}
METHOD(updown_handler_t, destroy, void,
private_updown_handler_t *this)
{
this->lock->destroy(this->lock);
this->attrs->destroy_function(this->attrs, (void*)attributes_destroy);
free(this);
}
/**
* See header
*/
updown_handler_t *updown_handler_create()
{
private_updown_handler_t *this;
INIT(this,
.public = {
.handler = {
.handle = _handle,
.release = _release,
.create_attribute_enumerator = enumerator_create_empty,
},
.create_dns_enumerator = _create_dns_enumerator,
.destroy = _destroy,
},
.attrs = linked_list_create(),
.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
);
return &this->public;
}
src/libcharon/plugins/updown/updown_handler.h
+57
View File
@@ -0,0 +1,57 @@
/*
* Copyright (C) 2012 Martin Willi
* Copyright (C) 2012 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup updown_handler updown_handler
* @{ @ingroup updown
*/
#ifndef UPDOWN_HANDLER_H_
#define UPDOWN_HANDLER_H_
#include <attributes/attribute_handler.h>
typedef struct updown_handler_t updown_handler_t;
/**
* Handler storing configuration attributes to pass to updown script.
*/
struct updown_handler_t {
/**
* Implements the attribute_handler_t interface
*/
attribute_handler_t handler;
/**
* Create an enumerator over received DNS servers.
*
* @param id unique IKE_SA identifier to get attributes for
* @return enumerator over host_t*
*/
enumerator_t* (*create_dns_enumerator)(updown_handler_t *this, u_int id);
/**
* Destroy a updown_handler_t.
*/
void (*destroy)(updown_handler_t *this);
};
/**
* Create a updown_handler instance.
*/
updown_handler_t *updown_handler_create();
#endif /** UPDOWN_HANDLER_H_ @}*/
src/libcharon/plugins/updown/updown_listener.c
+94 -18
View File
@@ -38,6 +38,11 @@ struct private_updown_listener_t {
* List of cached interface names
*/
linked_list_t *iface_cache;
/**
* DNS attribute handler
*/
updown_handler_t *handler;
};
typedef struct cache_entry_t cache_entry_t;
@@ -90,6 +95,85 @@ static char* uncache_iface(private_updown_listener_t *this, u_int32_t reqid)
return iface;
}
/**
* Create variables for handled DNS attributes
*/
static char *make_dns_vars(private_updown_listener_t *this, ike_sa_t *ike_sa)
{
enumerator_t *enumerator;
host_t *host;
int v4 = 0, v6 = 0;
char total[512] = "", current[64];
if (!this->handler)
{
return strdup("");
}
enumerator = this->handler->create_dns_enumerator(this->handler,
ike_sa->get_unique_id(ike_sa));
while (enumerator->enumerate(enumerator, &host))
{
switch (host->get_family(host))
{
case AF_INET:
snprintf(current, sizeof(current),
"PLUTO_DNS4_%d='%H' ", ++v4, host);
break;
case AF_INET6:
snprintf(current, sizeof(current),
"PLUTO_DNS6_%d='%H' ", ++v6, host);
break;
default:
continue;
}
strncat(total, current, sizeof(total) - strlen(total) - 1);
}
enumerator->destroy(enumerator);
return strdup(total);
}
/**
* Create variables for local virtual IPs
*/
static char *make_vip_vars(private_updown_listener_t *this, ike_sa_t *ike_sa)
{
enumerator_t *enumerator;
host_t *host;
int v4 = 0, v6 = 0;
char total[512] = "", current[64];
bool first = TRUE;
enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, TRUE);
while (enumerator->enumerate(enumerator, &host))
{
if (first)
{ /* legacy variable for first VIP */
snprintf(current, sizeof(current),
"PLUTO_MY_SOURCEIP='%H' ", host);
strncat(total, current, sizeof(total) - strlen(total) - 1);
}
switch (host->get_family(host))
{
case AF_INET:
snprintf(current, sizeof(current),
"PLUTO_MY_SOURCEIP4_%d='%H' ", ++v4, host);
break;
case AF_INET6:
snprintf(current, sizeof(current),
"PLUTO_MY_SOURCEIP6_%d='%H' ", ++v6, host);
break;
default:
continue;
}
strncat(total, current, sizeof(total) - strlen(total) - 1);
}
enumerator->destroy(enumerator);
return strdup(total);
}
METHOD(listener_t, child_updown, bool,
private_updown_listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
bool up)
@@ -97,11 +181,10 @@ METHOD(listener_t, child_updown, bool,
traffic_selector_t *my_ts, *other_ts;
enumerator_t *enumerator;
child_cfg_t *config;
host_t *vip, *me, *other;
host_t *me, *other;
char *script;
config = child_sa->get_config(child_sa);
vip = ike_sa->get_virtual_ip(ike_sa, TRUE);
script = config->get_updown(config);
me = ike_sa->get_my_host(ike_sa);
other = ike_sa->get_other_host(ike_sa);
@@ -117,7 +200,7 @@ METHOD(listener_t, child_updown, bool,
char command[1024];
host_t *my_client, *other_client;
u_int8_t my_client_mask, other_client_mask;
char *virtual_ip, *iface, *mark_in, *mark_out, *udp_enc;
char *virtual_ip, *iface, *mark_in, *mark_out, *udp_enc, *dns;
mark_t mark;
bool is_host, is_ipv6;
FILE *shell;
@@ -125,20 +208,7 @@ METHOD(listener_t, child_updown, bool,
my_ts->to_subnet(my_ts, &my_client, &my_client_mask);
other_ts->to_subnet(other_ts, &other_client, &other_client_mask);
if (vip)
{
if (asprintf(&virtual_ip, "PLUTO_MY_SOURCEIP='%H' ", vip) < 0)
{
virtual_ip = NULL;
}
}
else
{
if (asprintf(&virtual_ip, "") < 0)
{
virtual_ip = NULL;
}
}
virtual_ip = make_vip_vars(this, ike_sa);
/* check for the presence of an inbound mark */
mark = config->get_mark(config, TRUE);
@@ -209,6 +279,8 @@ METHOD(listener_t, child_updown, bool,
iface = uncache_iface(this, child_sa->get_reqid(child_sa));
}
dns = make_dns_vars(this, ike_sa);
/* determine IPv4/IPv6 and client/host situation */
is_host = my_ts->is_host(my_ts, me);
is_ipv6 = is_host ? (me->get_family(me) == AF_INET6) :
@@ -239,6 +311,7 @@ METHOD(listener_t, child_updown, bool,
"%s"
"%s"
"%s"
"%s"
"%s",
up ? "up" : "down",
is_host ? "-host" : "-client",
@@ -259,6 +332,7 @@ METHOD(listener_t, child_updown, bool,
mark_out,
udp_enc,
config->get_hostaccess(config) ? "PLUTO_HOST_ACCESS='1' " : "",
dns,
script);
my_client->destroy(my_client);
other_client->destroy(other_client);
@@ -266,6 +340,7 @@ METHOD(listener_t, child_updown, bool,
free(mark_in);
free(mark_out);
free(udp_enc);
free(dns);
free(iface);
DBG3(DBG_CHD, "running updown script: %s", command);
@@ -315,7 +390,7 @@ METHOD(updown_listener_t, destroy, void,
/**
* See header
*/
updown_listener_t *updown_listener_create()
updown_listener_t *updown_listener_create(updown_handler_t *handler)
{
private_updown_listener_t *this;
@@ -327,6 +402,7 @@ updown_listener_t *updown_listener_create()
.destroy = _destroy,
},
.iface_cache = linked_list_create(),
.handler = handler,
);
return &this->public;
src/libcharon/plugins/updown/updown_listener.h
+3 -1
View File
@@ -23,6 +23,8 @@
#include <bus/bus.h>
#include "updown_handler.h"
typedef struct updown_listener_t updown_listener_t;
/**
@@ -44,6 +46,6 @@ struct updown_listener_t {
/**
* Create a updown_listener instance.
*/
updown_listener_t *updown_listener_create();
updown_listener_t *updown_listener_create(updown_handler_t *handler);
#endif /** UPDOWN_LISTENER_H_ @}*/
src/libcharon/plugins/updown/updown_plugin.c
+21 -1
View File
@@ -15,8 +15,10 @@
#include "updown_plugin.h"
#include "updown_listener.h"
#include "updown_handler.h"
#include <daemon.h>
#include <hydra.h>
typedef struct private_updown_plugin_t private_updown_plugin_t;
@@ -34,6 +36,11 @@ struct private_updown_plugin_t {
* Listener interface, listens to CHILD_SA state changes
*/
updown_listener_t *listener;
/**
* Attribute handler, to pass DNS servers to updown
*/
updown_handler_t *handler;
};
METHOD(plugin_t, get_name, char*,
@@ -47,6 +54,12 @@ METHOD(plugin_t, destroy, void,
{
charon->bus->remove_listener(charon->bus, &this->listener->listener);
this->listener->destroy(this->listener);
if (this->handler)
{
hydra->attributes->remove_handler(hydra->attributes,
&this->handler->handler);
this->handler->destroy(this->handler);
}
free(this);
}
@@ -65,9 +78,16 @@ plugin_t *updown_plugin_create()
.destroy = _destroy,
},
},
.listener = updown_listener_create(),
);
if (lib->settings->get_bool(lib->settings,
"charon.plugins.updown.dns_handler", FALSE))
{
this->handler = updown_handler_create();
hydra->attributes->add_handler(hydra->attributes,
&this->handler->handler);
}
this->listener = updown_listener_create(this->handler);
charon->bus->add_listener(charon->bus, &this->listener->listener);
return &this->public.plugin;