denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

created pluto and scepclient now use libstrongswan-lite

Browse Source
This commit is contained in:
Andreas Steffen
2009-04-18 14:50:31 +00:00
parent 815510e637
commit a6e3ec1389
20 changed files with 216 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/Makefile.am
+5 -33
View File
@@ -90,49 +90,21 @@ AM_CFLAGS = \
-DPLUTO -DKLIPS -DDEBUG
pluto_LDADD = \
oid.o debug.o linked_list.o enumerator.o settings.o utils.o chunk.o \
$(LIBSTRONGSWANDIR)/libstrongswan-lite.la \
$(LIBFREESWANDIR)/libfreeswan.a \
$(LIBCRYPTODIR)/libcrypto.a \
-lgmp -lresolv -lpthread -ldl
if USE_LEAK_DETECTIVE
AM_CFLAGS += -DLEAK_DETECTIVE
pluto_LDADD += backtrace.o leak_detective.o
endif
_pluto_adns_LDADD = \
$(LIBFREESWANDIR)/libfreeswan.a \
-lresolv -ldl
dist_man_MANS = pluto.8 ipsec.secrets.5
# Copy functions from libstrongswan
oid.o : $(LIBSTRONGSWANDIR)/asn1/oid.c $(LIBSTRONGSWANDIR)/asn1/oid.h
$(COMPILE) -c -o $@ $<
debug.o : $(LIBSTRONGSWANDIR)/debug.c $(LIBSTRONGSWANDIR)/debug.h
$(COMPILE) -c -o $@ $<
backtrace.o : $(LIBSTRONGSWANDIR)/utils/backtrace.c $(LIBSTRONGSWANDIR)/utils/backtrace.h
$(COMPILE) -c -o $@ $<
leak_detective.o : $(LIBSTRONGSWANDIR)/utils/leak_detective.c $(LIBSTRONGSWANDIR)/utils/leak_detective.h
$(COMPILE) -c -o $@ $<
linked_list.o : $(LIBSTRONGSWANDIR)/utils/linked_list.c $(LIBSTRONGSWANDIR)/utils/linked_list.h
$(COMPILE) -c -o $@ $<
enumerator.o : $(LIBSTRONGSWANDIR)/utils/enumerator.c $(LIBSTRONGSWANDIR)/utils/enumerator.h
$(COMPILE) -c -o $@ $<
settings.o : $(LIBSTRONGSWANDIR)/settings.c $(LIBSTRONGSWANDIR)/settings.h
$(COMPILE) -c -o $@ $<
utils.o : $(LIBSTRONGSWANDIR)/utils.c $(LIBSTRONGSWANDIR)/utils.h
$(COMPILE) -c -o $@ $<
chunk.o : $(LIBSTRONGSWANDIR)/chunk.c $(LIBSTRONGSWANDIR)/chunk.h
$(COMPILE) -c -o $@ $<
# This compile option activates the memory leak detective
if USE_LEAK_DETECTIVE
AM_CFLAGS += -DLEAK_DETECTIVE
endif
# This compile option activates the sending of a strongSwan VID
if USE_VENDORID
src/pluto/ac.c
+9 -10
View File
@@ -746,9 +746,9 @@ check_ac_validity(const x509acert_t *ac)
time(&current_time);
DBG(DBG_CONTROL | DBG_PARSING,
DBG_log(" not before : %s", timetoa(&ac->notBefore, TRUE));
DBG_log(" current time: %s", timetoa(&current_time, TRUE));
DBG_log(" not after : %s", timetoa(&ac->notAfter, TRUE));
DBG_log(" not before : %T", &ac->notBefore, TRUE);
DBG_log(" current time: %T", &current_time, TRUE);
DBG_log(" not after : %T", &ac->notAfter, TRUE);
)
if (current_time < ac->notBefore)
@@ -917,7 +917,7 @@ list_acerts(bool utc)
{
u_char buf[BUF_LEN];
whack_log(RC_COMMENT, "%s",timetoa(&ac->installed, utc));
whack_log(RC_COMMENT, "%T", &ac->installed, utc);
if (ac->entityName.ptr != NULL)
{
dntoa(buf, BUF_LEN, ac->entityName);
@@ -944,11 +944,11 @@ list_acerts(bool utc)
datatot(ac->serialNumber.ptr, ac->serialNumber.len, ':'
, buf, BUF_LEN);
whack_log(RC_COMMENT, " serial: %s", buf);
whack_log(RC_COMMENT, " validity: not before %s %s",
timetoa(&ac->notBefore, utc),
whack_log(RC_COMMENT, " validity: not before %T %s",
&ac->notBefore, utc,
(ac->notBefore < now)?"ok":"fatal (not valid yet)");
whack_log(RC_COMMENT, " not after %s %s",
timetoa(&ac->notAfter, utc),
whack_log(RC_COMMENT, " not after %T %s",
&ac->notAfter, utc,
check_expiry(ac->notAfter, ACERT_WARNING_INTERVAL, TRUE));
if (ac->authKeyID.ptr != NULL)
{
@@ -986,8 +986,7 @@ list_groups(bool utc)
{
ietfAttr_t *attr = list->attr;
whack_log(RC_COMMENT, "%s, count: %d", timetoa(&attr->installed, utc),
attr->count);
whack_log(RC_COMMENT, "%T, count: %d", &attr->installed, utc, attr->count);
switch (attr->kind)
{
src/pluto/asn1.c
+1 -1
View File
@@ -544,7 +544,7 @@ debug_asn1_simple_object(chunk_t object, asn1_t type, u_int cond)
case ASN1_GENERALIZEDTIME:
DBG(DBG_PARSING,
time_t time = asn1totime(&object, type);
DBG_log(" '%s'", timetoa(&time, TRUE));
DBG_log(" '%T'", &time, TRUE);
)
return;
default:
src/pluto/ca.c
+3 -3
View File
@@ -661,11 +661,11 @@ list_ca_infos(bool utc)
/* strictpolicy per CA not supported yet
*
whack_log(RC_COMMENT, "%s, \"%s\", strictcrlpolicy: %s"
, timetoa(&ca->installed, utc), ca->name
whack_log(RC_COMMENT, "%T, \"%s\", strictcrlpolicy: %s"
, &ca->installed, utc, ca->name
, ca->strictcrlpolicy? "yes":"no");
*/
whack_log(RC_COMMENT, "%s, \"%s\"", timetoa(&ca->installed, utc), ca->name);
whack_log(RC_COMMENT, "%T, \"%s\"", &ca->installed, utc, ca->name);
dntoa(buf, BUF_LEN, ca->authName);
whack_log(RC_COMMENT, " authname: '%s'", buf);
if (ca->ldaphost != NULL)
src/pluto/crl.c
+7 -8
View File
@@ -677,8 +677,7 @@ verify_by_crl(const x509cert_t *cert, time_t *until, time_t *revocationDate
{
fetch_req_t *req;
plog("crl update is overdue since %s"
, timetoa(until, TRUE));
plog("crl update is overdue since %T", until, TRUE);
/* try to fetch a crl update */
req = build_crl_fetch_request(crl->issuer
@@ -738,8 +737,8 @@ list_crls(bool utc, bool strict)
revokedCert = revokedCert->next;
}
whack_log(RC_COMMENT, "%s, revoked certs: %d",
timetoa(&crl->installed, utc), revoked);
whack_log(RC_COMMENT, "%T, revoked certs: %d",
&crl->installed, utc, revoked);
dntoa(buf, BUF_LEN, crl->issuer);
whack_log(RC_COMMENT, " issuer: '%s'", buf);
if (crl->crlNumber.ptr != NULL)
@@ -750,10 +749,10 @@ list_crls(bool utc, bool strict)
}
list_distribution_points(crl->distributionPoints);
whack_log(RC_COMMENT, " updates: this %s",
timetoa(&crl->thisUpdate, utc));
whack_log(RC_COMMENT, " next %s %s",
timetoa(&crl->nextUpdate, utc),
whack_log(RC_COMMENT, " updates: this %T",
&crl->thisUpdate, utc);
whack_log(RC_COMMENT, " next %T %s",
&crl->nextUpdate, utc,
check_expiry(crl->nextUpdate, CRL_WARNING_INTERVAL, strict));
if (crl->authKeyID.ptr != NULL)
{
src/pluto/defs.c
-30
View File
@@ -143,36 +143,6 @@ write_chunk(const char *filename, const char *label, chunk_t ch
}
}
/* Names of the months */
static const char* months[] = {
"Jan", "Feb", "Mar", "Apr", "May", "Jun",
"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
};
/*
* Display a date either in local or UTC time
*/
char*
timetoa(const time_t *time, bool utc)
{
static char buf[TIMETOA_BUF];
if (*time == UNDEFINED_TIME)
sprintf(buf, "--- -- --:--:--%s----", (utc)?" UTC ":" ");
else
{
struct tm *t = (utc)? gmtime(time) : localtime(time);
sprintf(buf, "%s %02d %02d:%02d:%02d%s%04d",
months[t->tm_mon], t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec,
(utc)?" UTC ":" ", t->tm_year + 1900
);
}
return buf;
}
/* checks if the expiration date has been reached and
* warns during the warning_interval of the imminent
* expiry. strict=TRUE declares a fatal error,
src/pluto/defs.h
-3
View File
@@ -67,9 +67,6 @@ extern void mv_chunk(u_char **pos, chunk_t content);
extern bool write_chunk(const char *filename, const char *label, chunk_t ch
,mode_t mask, bool force);
/* display a date either in local or UTC time */
extern char* timetoa(const time_t *time, bool utc);
/* warns a predefined interval before expiry */
extern const char* check_expiry(time_t expiration_date,
int warning_interval, bool strict);
src/pluto/fetch.c
+2 -2
View File
@@ -1043,8 +1043,8 @@ list_crl_fetch_requests(bool utc)
{
u_char buf[BUF_LEN];
whack_log(RC_COMMENT, "%s, trials: %d"
, timetoa(&req->installed, utc), req->trials);
whack_log(RC_COMMENT, "%T, trials: %d"
, &req->installed, utc, req->trials);
dntoa(buf, BUF_LEN, req->issuer);
whack_log(RC_COMMENT, " issuer: '%s'", buf);
if (req->authKeyID.ptr != NULL)
src/pluto/kernel.c
+1 -1
View File
@@ -2282,7 +2282,7 @@ get_sa_info(struct state *st, bool inbound, u_int *bytes, time_t *use_time)
if (!kernel_ops->get_policy(&sa, inbound, use_time))
return FALSE;
DBG(DBG_KLIPS,
DBG_log(" use_time: %s", timetoa(use_time, FALSE))
DBG_log(" use_time: %T", use_time, FALSE)
)
}
return TRUE;
src/pluto/keys.c
+4 -6
View File
@@ -1528,14 +1528,12 @@ void list_public_keys(bool utc)
if (key->alg == PUBKEY_ALG_RSA)
{
char buf[BUF_LEN];
char expires_buf[TIMETOA_BUF];
idtoa(&key->id, buf, BUF_LEN);
strcpy(expires_buf, timetoa(&key->until_time, utc));
whack_log(RC_COMMENT, "%s, %4d RSA Key %s, until %s %s",
timetoa(&key->installed_time, utc), 8*key->u.rsa.k, key->u.rsa.keyid,
expires_buf,
whack_log(RC_COMMENT, "%T, %4d RSA Key %s, until %T %s",
&key->installed_time, utc,
8*key->u.rsa.k, key->u.rsa.keyid,
&key->until_time, utc,
check_expiry(key->until_time, PUBKEY_WARNING_INTERVAL, TRUE));
whack_log(RC_COMMENT," %s '%s'",
enum_show(&ident_names, key->id.kind), buf);
src/pluto/library.c
+18
View File
@@ -21,6 +21,7 @@
#include <stdlib.h>
#include <utils.h>
#include <chunk.h>
#ifdef LEAK_DETECTIVE
#include <utils/leak_detective.h>
#endif
@@ -58,6 +59,7 @@ void library_deinit()
private_library_t *this = (private_library_t*)lib;
this->public.settings->destroy(this->public.settings);
this->public.printf_hook->destroy(this->public.printf_hook);
#ifdef LEAK_DETECTIVE
if (this->detective)
@@ -74,6 +76,7 @@ void library_deinit()
*/
void library_init(char *settings)
{
printf_hook_t *pfh;
private_library_t *this = malloc_thing(private_library_t);
lib = &this->public;
@@ -83,6 +86,21 @@ void library_init(char *settings)
this->detective = leak_detective_create();
#endif /* LEAK_DETECTIVE */
pfh = printf_hook_create();
this->public.printf_hook = pfh;
pfh->add_handler(pfh, 'b', mem_printf_hook,
PRINTF_HOOK_ARGTYPE_POINTER, PRINTF_HOOK_ARGTYPE_INT,
PRINTF_HOOK_ARGTYPE_END);
pfh->add_handler(pfh, 'B', chunk_printf_hook,
PRINTF_HOOK_ARGTYPE_POINTER, PRINTF_HOOK_ARGTYPE_END);
pfh->add_handler(pfh, 'T', time_printf_hook,
PRINTF_HOOK_ARGTYPE_POINTER, PRINTF_HOOK_ARGTYPE_INT,
PRINTF_HOOK_ARGTYPE_END);
pfh->add_handler(pfh, 'V', time_delta_printf_hook,
PRINTF_HOOK_ARGTYPE_POINTER, PRINTF_HOOK_ARGTYPE_POINTER,
PRINTF_HOOK_ARGTYPE_END);
this->public.settings = settings_create(settings);
}
src/pluto/library.h
+6
View File
@@ -27,6 +27,12 @@ typedef struct library_t library_t;
* Libstrongswan library context, contains library relevant globals.
*/
struct library_t {
/**
* Printf hook registering facility
*/
printf_hook_t *printf_hook;
/**
* various settings loaded from settings file
*/
src/pluto/ocsp.c
+3 -3
View File
@@ -615,7 +615,7 @@ list_ocsp_locations(ocsp_location_t *location, bool requests, bool utc
{
char thisUpdate[TIMETOA_BUF];
strcpy(thisUpdate, timetoa(&certinfo->thisUpdate, utc));
snprintf(thisUpdate, TIMETOA_BUF, "%T", &certinfo->thisUpdate, utc);
if (requests)
{
@@ -629,8 +629,8 @@ list_ocsp_locations(ocsp_location_t *location, bool requests, bool utc
}
else
{
whack_log(RC_COMMENT, "%s, until %s %s", thisUpdate
, timetoa(&certinfo->nextUpdate, utc)
whack_log(RC_COMMENT, "%s, until %T %s", thisUpdate
, &certinfo->nextUpdate, utc
, check_expiry(certinfo->nextUpdate, OCSP_WARNING_INTERVAL, strict));
}
datatot(certinfo->serialNumber.ptr, certinfo->serialNumber.len, ':'
src/pluto/pgp.c
+6 -6
View File
@@ -195,7 +195,7 @@ parse_pgp_pubkey_packet(chunk_t *packet, pgpcert_t *cert)
cert->created = (time_t)pgp_size(packet, 4);
DBG(DBG_PARSING,
DBG_log("L3 - created:");
DBG_log(" %s", timetoa(&cert->created, TRUE))
DBG_log(" %T", &cert->created, TRUE)
)
if (version == 3)
@@ -209,7 +209,7 @@ parse_pgp_pubkey_packet(chunk_t *packet, pgpcert_t *cert)
DBG(DBG_PARSING,
DBG_log("L3 - until:");
DBG_log(" %s", timetoa(&cert->until, TRUE));
DBG_log(" %T", &cert->until, TRUE);
)
}
@@ -403,7 +403,7 @@ parse_pgp_signature_packet(chunk_t *packet, pgpcert_t *cert)
created = (time_t)pgp_size(packet, 4);
DBG(DBG_PARSING,
DBG_log("L3 - created:");
DBG_log(" %s", timetoa(&cert->created, TRUE))
DBG_log(" %T", &cert->created, TRUE)
)
/* key ID of signer - 8 bytes */
@@ -633,14 +633,14 @@ list_pgp_end_certs(bool utc)
c.type = CERT_PGP;
c.u.pgp = cert;
whack_log(RC_COMMENT, "%s, count: %d", timetoa(&cert->installed, utc), cert->count);
whack_log(RC_COMMENT, "%T, count: %d", &cert->installed, utc), cert->count;
datatot(cert->fingerprint, PGP_FINGERPRINT_SIZE, 'x', buf, BUF_LEN);
whack_log(RC_COMMENT, " fingerprint: %s", buf);
form_keyid(cert->publicExponent, cert->modulus, buf, &keysize);
whack_log(RC_COMMENT, " pubkey: %4d RSA Key %s%s", 8*keysize, buf,
(has_private_key(c))? ", has private key" : "");
whack_log(RC_COMMENT, " created: %s", timetoa(&cert->created, utc));
whack_log(RC_COMMENT, " until: %s %s", timetoa(&cert->until, utc),
whack_log(RC_COMMENT, " created: %T", &cert->created, utc);
whack_log(RC_COMMENT, " until: %T %s", &cert->until, utc,
check_expiry(cert->until, CA_CERT_WARNING_INTERVAL, TRUE));
cert = cert->next;
}
src/pluto/plutomain.c
+53 -2
View File
@@ -1,6 +1,7 @@
/* Pluto main program
* Copyright (C) 1997 Angelos D. Keromytis.
* Copyright (C) 1998-2001 D. Hugh Redelmeier.
* Copyright (C) 2009 Andreas Steffen
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
@@ -17,6 +18,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <syslog.h>
#include <unistd.h>
#include <ctype.h>
#include <errno.h>
@@ -39,6 +41,7 @@
#include <freeswan.h>
#include <library.h>
#include <debug.h>
#include <pfkeyv2.h>
#include <pfkey.h>
@@ -188,8 +191,7 @@ fill_lock(int lockfd, pid_t pid)
return ok;
}
static void
delete_lock(void)
static void delete_lock(void)
{
if (pluto_lock_created)
{
@@ -198,6 +200,48 @@ delete_lock(void)
}
}
static int debug_level = 1;
/**
* pluto dbg function
*/
static void pluto_dbg(int level, char *fmt, ...)
{
int priority = LOG_INFO;
char buffer[8192];
char *current = buffer, *next;
va_list args;
if (level <= debug_level)
{
va_start(args, fmt);
if (log_to_stderr)
{
vfprintf(stderr, fmt, args);
fprintf(stderr, "\n");
}
if (log_to_syslog)
{
/* write in memory buffer first */
vsnprintf(buffer, sizeof(buffer), fmt, args);
/* do a syslog with every line */
while (current)
{
next = strchr(current, '\n');
if (next)
{
*(next++) = '\0';
}
syslog(priority, "%s\n", current);
current = next;
}
}
va_end(args);
}
}
/* by default pluto sends certificate requests to its peers */
bool no_cr_send = FALSE;
@@ -506,9 +550,13 @@ main(int argc, char **argv)
/* select between logging methods */
if (log_to_stderr_desired)
{
log_to_syslog = FALSE;
}
else
{
log_to_stderr = FALSE;
}
/* set the logging function of pfkey debugging */
#ifdef DEBUG
@@ -597,6 +645,9 @@ main(int argc, char **argv)
abort();
}
/* enable pluto debugging hook */
dbg = pluto_dbg;
init_constants();
init_log("pluto");
src/pluto/smartcard.c
+2 -2
View File
@@ -1939,8 +1939,8 @@ scx_list(bool utc)
while (sc != NULL)
{
whack_log(RC_COMMENT, "%s, #%d, count: %d"
, timetoa(&sc->last_load, utc)
whack_log(RC_COMMENT, "%T, #%d, count: %d"
, &sc->last_load, utc
, sc->number
, sc->count);
whack_log(RC_COMMENT, " %s, session %s, logged %s, has %s"
src/pluto/x509.c
+10 -10
View File
@@ -2104,9 +2104,9 @@ check_validity(const x509cert_t *cert, time_t *until)
time(&current_time);
DBG(DBG_CONTROL | DBG_PARSING ,
DBG_log(" not before : %s", timetoa(&cert->notBefore, TRUE));
DBG_log(" current time: %s", timetoa(&current_time, TRUE));
DBG_log(" not after : %s", timetoa(&cert->notAfter, TRUE));
DBG_log(" not before : %T", &cert->notBefore, TRUE);
DBG_log(" current time: %T", &current_time, TRUE);
DBG_log(" not after : %T", &cert->notAfter, TRUE);
)
if (cert->notAfter < *until)
@@ -2245,8 +2245,8 @@ verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
}
break;
case CERT_REVOKED:
plog("certificate was revoked on %s, reason: %s"
, timetoa(&revocationDate, TRUE)
plog("certificate was revoked on %T, reason: %s"
, &revocationDate, TRUE
, enum_name(&crl_reason_names, revocationReason));
remove_x509_public_key(cert);
return FALSE;
@@ -2303,7 +2303,7 @@ list_x509cert_chain(const char *caption, x509cert_t* cert, u_char auth_flags
first = FALSE;
}
whack_log(RC_COMMENT, "%s, count: %d", timetoa(&cert->installed, utc),
whack_log(RC_COMMENT, "%T, count: %d", &cert->installed, utc,
cert->count);
dntoa(buf, BUF_LEN, cert->subject);
whack_log(RC_COMMENT, " subject: '%s'", buf);
@@ -2317,11 +2317,11 @@ list_x509cert_chain(const char *caption, x509cert_t* cert, u_char auth_flags
, 8*keysize, keyid
, cert->smartcard ? ", on smartcard" :
(has_private_key(c)? ", has private key" : ""));
whack_log(RC_COMMENT, " validity: not before %s %s",
timetoa(&cert->notBefore, utc),
whack_log(RC_COMMENT, " validity: not before %T %s",
&cert->notBefore, utc,
(cert->notBefore < now)?"ok":"fatal (not valid yet)");
whack_log(RC_COMMENT, " not after %s %s",
timetoa(&cert->notAfter, utc),
whack_log(RC_COMMENT, " not after %T %s",
&cert->notAfter, utc,
check_expiry(cert->notAfter, CA_CERT_WARNING_INTERVAL, TRUE));
if (cert->subjectKeyID.ptr != NULL)
{