denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added a UNIX socket based control backend to whitelist plugin

Browse Source
This commit is contained in:
Martin Willi
2011-02-28 15:00:46 +01:00
parent 5e603aba4e
commit 53f2a7c712
5 changed files with 337 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/whitelist/Makefile.am
+4 -2
View File
@@ -2,7 +2,8 @@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libhydra \
-I$(top_srcdir)/src/libcharon
AM_CFLAGS = -rdynamic
AM_CFLAGS = -rdynamic \
-DIPSEC_PIDDIR=\"${piddir}\"
if MONOLITHIC
noinst_LTLIBRARIES = libstrongswan-whitelist.la
@@ -11,6 +12,7 @@ plugin_LTLIBRARIES = libstrongswan-whitelist.la
endif
libstrongswan_whitelist_la_SOURCES = whitelist_plugin.h whitelist_plugin.c \
whitelist_listener.h whitelist_listener.c
whitelist_listener.h whitelist_listener.c whitelist_msg.h \
whitelist_control.h whitelist_control.c
libstrongswan_whitelist_la_LDFLAGS = -module -avoid-version
src/libcharon/plugins/whitelist/whitelist_control.c
+227
View File
@@ -0,0 +1,227 @@
/*
* Copyright (C) 2011 Martin Willi
* Copyright (C) 2011 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "whitelist_control.h"
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <unistd.h>
#include <errno.h>
#include <daemon.h>
#include <threading/thread.h>
#include <processing/jobs/callback_job.h>
#include "whitelist_msg.h"
typedef struct private_whitelist_control_t private_whitelist_control_t;
/**
* Private data of an whitelist_control_t object.
*/
struct private_whitelist_control_t {
/**
* Public whitelist_control_t interface.
*/
whitelist_control_t public;
/**
* Whitelist
*/
whitelist_listener_t *listener;
/**
* Whitelist unix socket file descriptor
*/
int socket;
/**
* Callback job dispatching commands
*/
callback_job_t *job;
};
/**
* Open whitelist unix socket
*/
static bool open_socket(private_whitelist_control_t *this)
{
struct sockaddr_un addr;
mode_t old;
addr.sun_family = AF_UNIX;
strcpy(addr.sun_path, WHITELIST_SOCKET);
this->socket = socket(AF_UNIX, SOCK_SEQPACKET, 0);
if (this->socket == -1)
{
DBG1(DBG_CFG, "creating whitelist socket failed");
return FALSE;
}
unlink(addr.sun_path);
old = umask(~(S_IRWXU | S_IRWXG));
if (bind(this->socket, (struct sockaddr*)&addr, sizeof(addr)) < 0)
{
DBG1(DBG_CFG, "binding whitelist socket failed: %s", strerror(errno));
close(this->socket);
return FALSE;
}
umask(old);
if (chown(addr.sun_path, charon->uid, charon->gid) != 0)
{
DBG1(DBG_CFG, "changing whitelist socket permissions failed: %s",
strerror(errno));
}
if (listen(this->socket, 10) < 0)
{
DBG1(DBG_CFG, "listening on whitelist socket failed: %s", strerror(errno));
close(this->socket);
unlink(addr.sun_path);
return FALSE;
}
return TRUE;
}
/**
* Dispatch a received message
*/
static void dispatch(private_whitelist_control_t *this,
int fd, whitelist_msg_t *msg)
{
identification_t *id, *current;
enumerator_t *enumerator;
msg->id[sizeof(msg->id)-1] = 0;
id = identification_create_from_string(msg->id);
switch (msg->type)
{
case WHITELIST_ADD:
this->listener->add(this->listener, id);
break;
case WHITELIST_REMOVE:
this->listener->remove(this->listener, id);
break;
case WHITELIST_LIST:
enumerator = this->listener->create_enumerator(this->listener);
while (enumerator->enumerate(enumerator, &current))
{
if (current->matches(current, id))
{
snprintf(msg->id, sizeof(msg->id), "%Y", current);
if (send(fd, msg, sizeof(*msg), 0) != sizeof(*msg))
{
DBG1(DBG_CFG, "listing whitelist failed");
break;
}
}
}
enumerator->destroy(enumerator);
msg->type = WHITELIST_END;
memset(msg->id, 0, sizeof(msg->id));
send(fd, msg, sizeof(*msg), 0);
break;
case WHITELIST_FLUSH:
this->listener->flush(this->listener, id);
break;
default:
DBG1(DBG_CFG, "received unknown whitelist command");
break;
}
id->destroy(id);
}
/**
* Accept whitelist control connections, dispatch
*/
static job_requeue_t receive(private_whitelist_control_t *this)
{
struct sockaddr_un addr;
int fd, len = sizeof(addr);
whitelist_msg_t msg;
bool oldstate;
oldstate = thread_cancelability(TRUE);
fd = accept(this->socket, (struct sockaddr*)&addr, &len);
thread_cancelability(oldstate);
if (fd != -1)
{
while (TRUE)
{
oldstate = thread_cancelability(TRUE);
len = recv(fd, &msg, sizeof(msg), 0);
thread_cancelability(oldstate);
if (len == sizeof(msg))
{
dispatch(this, fd, &msg);
}
else
{
if (len != 0)
{
DBG1(DBG_CFG, "receiving whitelist msg failed: %s",
strerror(errno));
}
break;
}
}
close(fd);
}
else
{
DBG1(DBG_CFG, "accepting whitelist connection failed: %s",
strerror(errno));
}
return JOB_REQUEUE_FAIR;
}
METHOD(whitelist_control_t, destroy, void,
private_whitelist_control_t *this)
{
this->job->cancel(this->job);
close(this->socket);
free(this);
}
/**
* See header
*/
whitelist_control_t *whitelist_control_create(whitelist_listener_t *listener)
{
private_whitelist_control_t *this;
INIT(this,
.public = {
.destroy = _destroy,
},
.listener = listener,
);
if (!open_socket(this))
{
free(this);
return NULL;
}
this->job = callback_job_create((callback_job_cb_t)receive,
this, NULL, NULL);
lib->processor->queue_job(lib->processor, (job_t*)this->job);
return &this->public;
}
src/libcharon/plugins/whitelist/whitelist_control.h
+44
View File
@@ -0,0 +1,44 @@
/*
* Copyright (C) 2011 Martin Willi
* Copyright (C) 2011 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup whitelist_control whitelist_control
* @{ @ingroup whitelist
*/
#ifndef WHITELIST_CONTROL_H_
#define WHITELIST_CONTROL_H_
#include "whitelist_listener.h"
typedef struct whitelist_control_t whitelist_control_t;
/**
* Whitelist UNIX control socket.
*/
struct whitelist_control_t {
/**
* Destroy a whitelist_control_t.
*/
void (*destroy)(whitelist_control_t *this);
};
/**
* Create a whitelist_control instance.
*/
whitelist_control_t *whitelist_control_create(whitelist_listener_t *listener);
#endif /** WHITELIST_CONTROL_H_ @}*/
src/libcharon/plugins/whitelist/whitelist_msg.h
+54
View File
@@ -0,0 +1,54 @@
/*
* Copyright (C) 2011 Martin Willi
* Copyright (C) 2011 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup whitelist_msg whitelist_msg
* @{ @ingroup whitelist
*/
#ifndef WHITELIST_MSG_H_
#define WHITELIST_MSG_H_
#define WHITELIST_SOCKET IPSEC_PIDDIR "/charon.wlst"
typedef struct whitelist_msg_t whitelist_msg_t;
/**
* Message type.
*/
enum {
/* add whitelist entry */
WHITELIST_ADD = 1,
/* remove whitelist entry */
WHITELIST_REMOVE = 2,
/* list identities matching id, gets responded with LIST messages */
WHITELIST_LIST = 3,
/* indicates end of list in a series of LIST messages */
WHITELIST_END = 4,
/* flush identities matching id */
WHITELIST_FLUSH = 5,
};
/**
* Message to exchange over whitelist
*/
struct whitelist_msg_t {
/** message type */
int type;
/** null terminated identity */
char id[64];
};
#endif /** WHITELIST_MSG_H_ @}*/
src/libcharon/plugins/whitelist/whitelist_plugin.c
+8
View File
@@ -16,6 +16,7 @@
#include "whitelist_plugin.h"
#include "whitelist_listener.h"
#include "whitelist_control.h"
#include <daemon.h>
@@ -35,6 +36,11 @@ struct private_whitelist_plugin_t {
* Listener checking whitelist entries during authorization
*/
whitelist_listener_t *listener;
/**
* Whitelist control socket
*/
whitelist_control_t *control;
};
METHOD(plugin_t, destroy, void,
@@ -42,6 +48,7 @@ METHOD(plugin_t, destroy, void,
{
charon->bus->remove_listener(charon->bus, &this->listener->listener);
this->listener->destroy(this->listener);
DESTROY_IF(this->control);
free(this);
}
@@ -60,6 +67,7 @@ plugin_t *whitelist_plugin_create()
},
.listener = whitelist_listener_create(),
);
this->control = whitelist_control_create(this->listener);
charon->bus->add_listener(charon->bus, &this->listener->listener);