denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ext-auth: Add an ext-auth plugin invoking an external authorization script

Browse Source 
Original patch courtesy of Vyronas Tsingaras.
This commit is contained in:
Martin Willi
2014-10-06 18:30:46 +02:00
parent 6890bdc7a0
commit b2c1973ffb
9 changed files with 512 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/Makefile.am
+7
View File
@@ -258,6 +258,13 @@ if MONOLITHIC
endif
endif
if USE_EXT_AUTH
SUBDIRS += plugins/ext_auth
if MONOLITHIC
libcharon_la_LIBADD += plugins/ext_auth/libstrongswan-ext-auth.la
endif
endif
if USE_EAP_IDENTITY
SUBDIRS += plugins/eap_identity
if MONOLITHIC
src/libcharon/plugins/ext_auth/Makefile.am
+18
View File
@@ -0,0 +1,18 @@
AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libhydra \
-I$(top_srcdir)/src/libcharon
AM_CFLAGS = \
$(PLUGIN_CFLAGS)
if MONOLITHIC
noinst_LTLIBRARIES = libstrongswan-ext-auth.la
else
plugin_LTLIBRARIES = libstrongswan-ext-auth.la
endif
libstrongswan_ext_auth_la_SOURCES = ext_auth_plugin.h ext_auth_plugin.c \
ext_auth_listener.h ext_auth_listener.c
libstrongswan_ext_auth_la_LDFLAGS = -module -avoid-version
src/libcharon/plugins/ext_auth/ext_auth_listener.c
+203
View File
@@ -0,0 +1,203 @@
/*
* Copyright (c) 2014 Vyronas Tsingaras ([email protected])
* Copyright (C) 2014 Martin Willi
* Copyright (C) 2014 revosec AG
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
/* for vasprintf() */
#define _GNU_SOURCE
#include "ext_auth_listener.h"
#include <daemon.h>
#include <utils/process.h>
#include <stdio.h>
#include <unistd.h>
typedef struct private_ext_auth_listener_t private_ext_auth_listener_t;
/**
* Private data of an ext_auth_listener_t object.
*/
struct private_ext_auth_listener_t {
/**
* Public ext_auth_listener_listener_t interface.
*/
ext_auth_listener_t public;
/**
* Path to authorization program
*/
char *script;
};
/**
* Allocate and push a format string to the environment
*/
static bool push_env(char *envp[], u_int count, char *fmt, ...)
{
int i = 0;
char *str;
va_list args;
while (envp[i])
{
if (++i + 1 >= count)
{
return FALSE;
}
}
va_start(args, fmt);
if (vasprintf(&str, fmt, args) >= 0)
{
envp[i] = str;
}
va_end(args);
return envp[i] != NULL;
}
/**
* Free all allocated environment strings
*/
static void free_env(char *envp[])
{
int i;
for (i = 0; envp[i]; i++)
{
free(envp[i]);
}
}
METHOD(listener_t, authorize, bool,
private_ext_auth_listener_t *this, ike_sa_t *ike_sa,
bool final, bool *success)
{
if (final)
{
FILE *shell;
process_t *process;
char *envp[32] = {};
int out, retval;
*success = FALSE;
push_env(envp, countof(envp), "IKE_UNIQUE_ID=%u",
ike_sa->get_unique_id(ike_sa));
push_env(envp, countof(envp), "IKE_NAME=%s",
ike_sa->get_name(ike_sa));
push_env(envp, countof(envp), "IKE_LOCAL_HOST=%H",
ike_sa->get_my_host(ike_sa));
push_env(envp, countof(envp), "IKE_REMOTE_HOST=%H",
ike_sa->get_other_host(ike_sa));
push_env(envp, countof(envp), "IKE_LOCAL_ID=%Y",
ike_sa->get_my_id(ike_sa));
push_env(envp, countof(envp), "IKE_REMOTE_ID=%Y",
ike_sa->get_other_id(ike_sa));
if (ike_sa->has_condition(ike_sa, COND_EAP_AUTHENTICATED) ||
ike_sa->has_condition(ike_sa, COND_XAUTH_AUTHENTICATED))
{
push_env(envp, countof(envp), "IKE_REMOTE_EAP_ID=%Y",
ike_sa->get_other_eap_id(ike_sa));
}
process = process_start_shell(envp, NULL, &out, NULL,
"2>&1 %s", this->script);
if (process)
{
shell = fdopen(out, "r");
if (shell)
{
while (TRUE)
{
char resp[128], *e;
if (fgets(resp, sizeof(resp), shell) == NULL)
{
if (ferror(shell))
{
DBG1(DBG_CFG, "error reading from ext-auth script");
}
break;
}
else
{
e = resp + strlen(resp);
if (e > resp && e[-1] == '\n')
{
e[-1] = '\0';
}
DBG1(DBG_CHD, "ext-auth: %s", resp);
}
}
fclose(shell);
}
else
{
close(out);
}
if (process->wait(process, &retval))
{
if (retval == EXIT_SUCCESS)
{
*success = TRUE;
}
else
{
DBG1(DBG_CFG, "rejecting IKE_SA for ext-auth result: %d",
retval);
}
}
}
free_env(envp);
}
return TRUE;
}
METHOD(ext_auth_listener_t, destroy, void,
private_ext_auth_listener_t *this)
{
free(this);
}
/**
* See header
*/
ext_auth_listener_t *ext_auth_listener_create(char *script)
{
private_ext_auth_listener_t *this;
INIT(this,
.public = {
.listener = {
.authorize = _authorize,
},
.destroy = _destroy,
},
.script = script,
);
return &this->public;
}
src/libcharon/plugins/ext_auth/ext_auth_listener.h
+59
View File
@@ -0,0 +1,59 @@
/*
* Copyright (c) 2014 Vyronas Tsingaras ([email protected])
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
/**
* @defgroup ext_auth_listener ext_auth_listener
* @{ @ingroup ext_auth
*/
#ifndef EXT_AUTH_LISTENER_H_
#define EXT_AUTH_LISTENER_H_
#include <bus/listeners/listener.h>
typedef struct ext_auth_listener_t ext_auth_listener_t;
/**
* Listener using an external script to authorize connection
*/
struct ext_auth_listener_t {
/**
* Implements listener_t interface.
*/
listener_t listener;
/**
* Destroy the listener.
*/
void (*destroy)(ext_auth_listener_t *this);
};
/**
* Create ext_auth_listener instance.
*
* @param script path to authorization script
* @return listener instance
*/
ext_auth_listener_t *ext_auth_listener_create(char *script);
#endif /** ext_auth_LISTENER_H_ @}*/
src/libcharon/plugins/ext_auth/ext_auth_plugin.c
+156
View File
@@ -0,0 +1,156 @@
/*
* Copyright (c) 2014 Vyronas Tsingaras ([email protected])
* Copyright (C) 2014 Martin Willi
* Copyright (C) 2014 revosec AG
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
#include "ext_auth_plugin.h"
#include "ext_auth_listener.h"
#include <daemon.h>
typedef struct private_ext_auth_plugin_t private_ext_auth_plugin_t;
/**
* private data of ext_auth plugin
*/
struct private_ext_auth_plugin_t {
/**
* implements plugin interface
*/
ext_auth_plugin_t public;
/**
* Listener verifying peers during authorization
*/
ext_auth_listener_t *listener;
};
METHOD(plugin_t, get_name, char*,
private_ext_auth_plugin_t *this)
{
return "ext-auth";
}
/**
* Create a listener instance, NULL on error
*/
static ext_auth_listener_t* create_listener()
{
char *script;
script = lib->settings->get_str(lib->settings,
"%s.plugins.ext-auth.script", NULL, lib->ns);
if (!script)
{
DBG1(DBG_CFG, "no script for ext-auth script defined, disabled");
return NULL;
}
DBG1(DBG_CFG, "using ext-auth script '%s'", script);
return ext_auth_listener_create(script);
}
/**
* Register listener
*/
static bool plugin_cb(private_ext_auth_plugin_t *this,
plugin_feature_t *feature, bool reg, void *cb_data)
{
if (reg)
{
this->listener = create_listener();
if (!this->listener)
{
return FALSE;
}
charon->bus->add_listener(charon->bus, &this->listener->listener);
}
else
{
if (this->listener)
{
charon->bus->remove_listener(charon->bus, &this->listener->listener);
this->listener->destroy(this->listener);
}
}
return TRUE;
}
METHOD(plugin_t, get_features, int,
private_ext_auth_plugin_t *this, plugin_feature_t *features[])
{
static plugin_feature_t f[] = {
PLUGIN_CALLBACK((plugin_feature_callback_t)plugin_cb, NULL),
PLUGIN_PROVIDE(CUSTOM, "ext_auth"),
};
*features = f;
return countof(f);
}
METHOD(plugin_t, reload, bool,
private_ext_auth_plugin_t *this)
{
ext_auth_listener_t *listener;
/* reload new listener overlapped */
listener = create_listener();
if (listener)
{
charon->bus->add_listener(charon->bus, &listener->listener);
}
if (this->listener)
{
charon->bus->remove_listener(charon->bus, &this->listener->listener);
this->listener->destroy(this->listener);
}
this->listener = listener;
return TRUE;
}
METHOD(plugin_t, destroy, void,
private_ext_auth_plugin_t *this)
{
free(this);
}
/**
* Plugin constructor
*/
plugin_t *ext_auth_plugin_create()
{
private_ext_auth_plugin_t *this;
INIT(this,
.public = {
.plugin = {
.get_name = _get_name,
.get_features = _get_features,
.reload = _reload,
.destroy = _destroy,
},
},
);
return &this->public.plugin;
}
src/libcharon/plugins/ext_auth/ext_auth_plugin.h
+49
View File
@@ -0,0 +1,49 @@
/*
* Copyright (c) 2014 Vyronas Tsingaras ([email protected])
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
/**
* @defgroup ext_auth ext_auth
* @ingroup cplugins
*
* @defgroup ext_auth_plugin ext_auth_plugin
* @{ @ingroup ext_auth
*/
#ifndef EXT_AUTH_PLUGIN_H_
#define EXT_AUTH_PLUGIN_H_
#include <plugins/plugin.h>
typedef struct ext_auth_plugin_t ext_auth_plugin_t;
/**
* Plugin using an external script to authorize connections.
*/
struct ext_auth_plugin_t {
/**
* Implements plugin interface.
*/
plugin_t plugin;
};
#endif /** EXT_AUTH_PLUGIN_H_ @}*/