2005-11-11 11:20:45 +00:00
|
|
|
/*
|
2012-04-19 11:32:51 +00:00
|
|
|
* Copyright (C) 2006-2012 Tobias Brunner
|
2009-05-06 17:48:21 +00:00
|
|
|
* Copyright (C) 2005-2009 Martin Willi
|
2007-10-03 15:10:41 +00:00
|
|
|
* Copyright (C) 2006 Daniel Roethlisberger
|
2006-07-07 08:49:06 +00:00
|
|
|
* Copyright (C) 2005 Jan Hutter
|
2005-11-11 11:20:45 +00:00
|
|
|
* Hochschule fuer Technik Rapperswil
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
|
|
* under the terms of the GNU General Public License as published by the
|
|
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
|
|
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful, but
|
|
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
|
|
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
|
|
* for more details.
|
|
|
|
*/
|
|
|
|
|
2006-04-05 12:10:50 +00:00
|
|
|
/**
|
2010-03-12 15:56:54 +00:00
|
|
|
* @defgroup libcharon libcharon
|
2006-04-05 12:10:50 +00:00
|
|
|
*
|
2007-04-11 07:20:39 +00:00
|
|
|
* @defgroup bus bus
|
2010-03-12 15:56:54 +00:00
|
|
|
* @ingroup libcharon
|
2009-09-02 15:26:36 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* @defgroup listeners listeners
|
|
|
|
* @ingroup bus
|
2006-04-20 13:12:35 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* @defgroup config config
|
2010-03-12 15:56:54 +00:00
|
|
|
* @ingroup libcharon
|
2007-04-11 07:20:39 +00:00
|
|
|
*
|
|
|
|
* @defgroup control control
|
2010-03-12 15:56:54 +00:00
|
|
|
* @ingroup libcharon
|
2007-04-27 14:25:08 +00:00
|
|
|
*
|
2006-04-20 13:12:35 +00:00
|
|
|
* @defgroup encoding encoding
|
2010-03-12 15:56:54 +00:00
|
|
|
* @ingroup libcharon
|
2006-04-20 13:12:35 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* @defgroup payloads payloads
|
2006-04-20 13:12:35 +00:00
|
|
|
* @ingroup encoding
|
|
|
|
*
|
2010-07-12 08:57:46 +00:00
|
|
|
* @defgroup ckernel kernel
|
2010-03-12 15:56:54 +00:00
|
|
|
* @ingroup libcharon
|
2006-04-20 13:12:35 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* @defgroup network network
|
2010-03-12 15:56:54 +00:00
|
|
|
* @ingroup libcharon
|
2006-04-20 13:12:35 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* @defgroup cplugins plugins
|
2010-03-12 15:56:54 +00:00
|
|
|
* @ingroup libcharon
|
2006-04-20 13:12:35 +00:00
|
|
|
*
|
2010-07-05 13:24:58 +00:00
|
|
|
* @defgroup cprocessing processing
|
2010-03-12 15:56:54 +00:00
|
|
|
* @ingroup libcharon
|
2006-04-20 13:12:35 +00:00
|
|
|
*
|
2010-07-05 13:24:58 +00:00
|
|
|
* @defgroup cjobs jobs
|
|
|
|
* @ingroup cprocessing
|
2006-04-20 13:12:35 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* @defgroup sa sa
|
2010-03-12 15:56:54 +00:00
|
|
|
* @ingroup libcharon
|
2008-03-13 14:14:44 +00:00
|
|
|
*
|
2006-10-31 15:24:08 +00:00
|
|
|
* @defgroup authenticators authenticators
|
2008-03-13 14:14:44 +00:00
|
|
|
* @ingroup sa
|
2006-10-31 15:24:08 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* @defgroup eap eap
|
|
|
|
* @ingroup authenticators
|
2006-10-31 15:24:08 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* @defgroup tasks tasks
|
2006-10-31 15:24:08 +00:00
|
|
|
* @ingroup sa
|
2007-02-12 15:56:47 +00:00
|
|
|
*
|
2010-03-12 15:56:54 +00:00
|
|
|
* @addtogroup libcharon
|
2008-03-13 14:14:44 +00:00
|
|
|
* @{
|
2007-02-12 15:56:47 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* IKEv2 keying daemon.
|
2006-09-27 14:14:44 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* All IKEv2 stuff is handled in charon. It uses a newer and more flexible
|
|
|
|
* architecture than pluto. Charon uses a thread-pool (called processor),
|
|
|
|
* which allows parallel execution SA-management. All threads originate
|
|
|
|
* from the processor. Work is delegated to the processor by queueing jobs
|
|
|
|
* to it.
|
|
|
|
@verbatim
|
2009-09-02 15:26:36 +00:00
|
|
|
|
2008-03-13 14:14:44 +00:00
|
|
|
+---------------------------------+ +----------------------------+
|
|
|
|
| controller | | config |
|
2009-09-02 15:26:36 +00:00
|
|
|
+---------------------------------+ +----------------------------+
|
|
|
|
| | | ^ ^ ^
|
|
|
|
V V V | | |
|
|
|
|
|
2008-03-13 14:14:44 +00:00
|
|
|
+----------+ +-----------+ +------+ +----------+ +----+
|
|
|
|
| receiver | | | | | +------+ | CHILD_SA | | K |
|
|
|
|
+---+------+ | Scheduler | | IKE- | | IKE- |--+----------+ | e |
|
|
|
|
| | | | SA |--| SA | | CHILD_SA | | r |
|
|
|
|
+------+---+ +-----------+ | | +------+ +----------+ | n |
|
|
|
|
<->| socket | | | Man- | | e |
|
|
|
|
+------+---+ +-----------+ | ager | +------+ +----------+ | l |
|
|
|
|
| | | | | | IKE- |--| CHILD_SA | | - |
|
|
|
|
+---+------+ | Processor |---| |--| SA | +----------+ | I |
|
2009-09-02 15:26:36 +00:00
|
|
|
| sender | | | | | +------+ | f |
|
2008-03-13 14:14:44 +00:00
|
|
|
+----------+ +-----------+ +------+ +----+
|
2009-09-02 15:26:36 +00:00
|
|
|
|
|
|
|
| | | | | |
|
|
|
|
V V V V V V
|
|
|
|
+---------------------------------+ +----------------------------+
|
|
|
|
| Bus | | credentials |
|
|
|
|
+---------------------------------+ +----------------------------+
|
2008-03-13 14:14:44 +00:00
|
|
|
|
|
|
|
@endverbatim
|
2009-09-02 15:26:36 +00:00
|
|
|
* The scheduler is responsible to execute timed events. Jobs may be queued to
|
|
|
|
* the scheduler to get executed at a defined time (e.g. rekeying). The
|
2008-03-13 14:14:44 +00:00
|
|
|
* scheduler does not execute the jobs itself, it queues them to the processor.
|
2009-09-02 15:26:36 +00:00
|
|
|
*
|
|
|
|
* The IKE_SA manager managers all IKE_SA. It further handles the
|
2008-03-13 14:14:44 +00:00
|
|
|
* synchronization:
|
2009-09-02 15:26:36 +00:00
|
|
|
* Each IKE_SA must be checked out strictly and checked in again after use. The
|
|
|
|
* manager guarantees that only one thread may check out a single IKE_SA. This
|
2008-03-13 14:14:44 +00:00
|
|
|
* allows us to write the (complex) IKE_SAs routines non-threadsave.
|
2009-09-02 15:26:36 +00:00
|
|
|
* The IKE_SA contain the state and the logic of each IKE_SA and handle the
|
2008-03-13 14:14:44 +00:00
|
|
|
* messages.
|
2009-09-02 15:26:36 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* The CHILD_SA contains state about a IPsec security association and manages
|
2009-09-02 15:26:36 +00:00
|
|
|
* them. An IKE_SA may have multiple CHILD_SAs. Communication to the kernel
|
2008-03-13 14:14:44 +00:00
|
|
|
* takes place here through the kernel interface.
|
2009-09-02 15:26:36 +00:00
|
|
|
*
|
2008-03-13 14:14:44 +00:00
|
|
|
* The kernel interface installs IPsec security associations, policies, routes
|
2009-09-02 15:26:36 +00:00
|
|
|
* and virtual addresses. It further provides methods to enumerate interfaces
|
2008-03-13 14:14:44 +00:00
|
|
|
* and may notify the daemon about state changes at lower layers.
|
2009-09-02 15:26:36 +00:00
|
|
|
*
|
|
|
|
* The bus receives signals from the different threads and relays them to
|
|
|
|
* interested listeners. Debugging signals, but also important state changes or
|
|
|
|
* error messages are sent over the bus.
|
|
|
|
* Its listeners are not only for logging, but also to track the state of an
|
2008-03-13 14:14:44 +00:00
|
|
|
* IKE_SA.
|
2006-09-27 14:14:44 +00:00
|
|
|
*
|
2009-09-02 15:26:36 +00:00
|
|
|
* The controller, credential_manager, bus and backend_manager (config) are
|
2008-03-13 14:14:44 +00:00
|
|
|
* places where a plugin ca register itself to privide information or observe
|
|
|
|
* and control the daemon.
|
2006-09-27 14:14:44 +00:00
|
|
|
*/
|
|
|
|
|
2008-03-13 14:14:44 +00:00
|
|
|
#ifndef DAEMON_H_
|
|
|
|
#define DAEMON_H_
|
|
|
|
|
|
|
|
typedef struct daemon_t daemon_t;
|
|
|
|
|
|
|
|
#include <network/sender.h>
|
|
|
|
#include <network/receiver.h>
|
2010-02-22 13:56:35 +00:00
|
|
|
#include <network/socket_manager.h>
|
2008-03-13 14:14:44 +00:00
|
|
|
#include <control/controller.h>
|
|
|
|
#include <bus/bus.h>
|
|
|
|
#include <bus/listeners/file_logger.h>
|
|
|
|
#include <bus/listeners/sys_logger.h>
|
|
|
|
#include <sa/ike_sa_manager.h>
|
2009-05-06 17:48:21 +00:00
|
|
|
#include <sa/trap_manager.h>
|
2011-06-28 17:42:54 +00:00
|
|
|
#include <sa/shunt_manager.h>
|
2008-03-13 14:14:44 +00:00
|
|
|
#include <config/backend_manager.h>
|
2011-12-19 14:22:50 +00:00
|
|
|
#include <sa/eap/eap_manager.h>
|
|
|
|
#include <sa/xauth/xauth_manager.h>
|
2008-03-13 14:14:44 +00:00
|
|
|
|
2008-03-26 18:40:19 +00:00
|
|
|
#ifdef ME
|
2011-12-19 12:10:29 +00:00
|
|
|
#include <sa/ikev2/connect_manager.h>
|
|
|
|
#include <sa/ikev2/mediation_manager.h>
|
2008-03-26 18:40:19 +00:00
|
|
|
#endif /* ME */
|
2008-03-13 14:14:44 +00:00
|
|
|
|
2005-11-29 10:25:07 +00:00
|
|
|
/**
|
2008-04-03 08:37:24 +00:00
|
|
|
* Number of threads in the thread pool, if not specified in config.
|
2005-11-29 10:25:07 +00:00
|
|
|
*/
|
2008-04-03 08:37:24 +00:00
|
|
|
#define DEFAULT_THREADS 16
|
2005-11-16 12:06:34 +00:00
|
|
|
|
2005-11-29 10:25:07 +00:00
|
|
|
/**
|
2005-12-06 12:54:34 +00:00
|
|
|
* UDP Port on which the daemon will listen for incoming traffic.
|
2005-11-29 10:25:07 +00:00
|
|
|
*/
|
2006-02-13 13:42:01 +00:00
|
|
|
#define IKEV2_UDP_PORT 500
|
2005-11-17 08:44:28 +00:00
|
|
|
|
2006-06-22 06:36:28 +00:00
|
|
|
/**
|
|
|
|
* UDP Port to which the daemon will float to if NAT is detected.
|
|
|
|
*/
|
|
|
|
#define IKEV2_NATT_PORT 4500
|
|
|
|
|
2006-04-25 10:06:30 +00:00
|
|
|
/**
|
2008-03-13 14:14:44 +00:00
|
|
|
* Main class of daemon, contains some globals.
|
2006-10-30 14:07:05 +00:00
|
|
|
*/
|
2005-11-29 10:25:07 +00:00
|
|
|
struct daemon_t {
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2005-11-29 10:25:07 +00:00
|
|
|
/**
|
2010-02-22 13:56:35 +00:00
|
|
|
* Socket manager instance
|
2005-11-29 10:25:07 +00:00
|
|
|
*/
|
2010-02-22 13:56:35 +00:00
|
|
|
socket_manager_t *socket;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2005-11-29 10:25:07 +00:00
|
|
|
/**
|
2005-12-06 12:54:34 +00:00
|
|
|
* A ike_sa_manager_t instance.
|
2005-11-29 10:25:07 +00:00
|
|
|
*/
|
|
|
|
ike_sa_manager_t *ike_sa_manager;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2009-05-06 17:48:21 +00:00
|
|
|
/**
|
|
|
|
* Manager for triggering policies, called traps
|
|
|
|
*/
|
|
|
|
trap_manager_t *traps;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2011-06-28 17:42:54 +00:00
|
|
|
/**
|
|
|
|
* Manager for shunt PASS|DROP policies
|
|
|
|
*/
|
|
|
|
shunt_manager_t *shunts;
|
|
|
|
|
2006-03-16 15:25:06 +00:00
|
|
|
/**
|
2007-04-27 14:25:08 +00:00
|
|
|
* Manager for the different configuration backends.
|
2006-03-16 15:25:06 +00:00
|
|
|
*/
|
2007-04-27 14:25:08 +00:00
|
|
|
backend_manager_t *backends;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2005-11-29 10:25:07 +00:00
|
|
|
/**
|
2005-12-06 12:54:34 +00:00
|
|
|
* The Sender-Thread.
|
2009-09-04 13:02:11 +00:00
|
|
|
*/
|
2005-11-29 10:25:07 +00:00
|
|
|
sender_t *sender;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2005-11-29 10:25:07 +00:00
|
|
|
/**
|
2005-12-06 12:54:34 +00:00
|
|
|
* The Receiver-Thread.
|
2005-11-29 10:25:07 +00:00
|
|
|
*/
|
|
|
|
receiver_t *receiver;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2006-09-27 14:14:44 +00:00
|
|
|
/**
|
|
|
|
* The signaling bus.
|
|
|
|
*/
|
|
|
|
bus_t *bus;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2006-09-27 14:14:44 +00:00
|
|
|
/**
|
2008-11-11 10:52:37 +00:00
|
|
|
* A list of installed file_logger_t's
|
2006-09-27 14:14:44 +00:00
|
|
|
*/
|
2008-11-11 10:52:37 +00:00
|
|
|
linked_list_t *file_loggers;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2006-09-27 14:14:44 +00:00
|
|
|
/**
|
2008-11-11 10:52:37 +00:00
|
|
|
* A list of installed sys_logger_t's
|
2006-09-27 14:14:44 +00:00
|
|
|
*/
|
2008-11-11 10:52:37 +00:00
|
|
|
linked_list_t *sys_loggers;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2007-04-16 12:52:49 +00:00
|
|
|
/**
|
2008-03-13 14:14:44 +00:00
|
|
|
* Controller to control the daemon
|
|
|
|
*/
|
|
|
|
controller_t *controller;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2008-03-13 14:14:44 +00:00
|
|
|
/**
|
|
|
|
* EAP manager to maintain registered EAP methods
|
2006-03-16 15:25:06 +00:00
|
|
|
*/
|
2008-03-13 14:14:44 +00:00
|
|
|
eap_manager_t *eap;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2011-12-01 13:08:24 +00:00
|
|
|
/**
|
|
|
|
* XAuth manager to maintain registered XAuth methods
|
|
|
|
*/
|
|
|
|
xauth_manager_t *xauth;
|
|
|
|
|
2008-03-26 18:40:19 +00:00
|
|
|
#ifdef ME
|
2007-10-03 15:10:41 +00:00
|
|
|
/**
|
|
|
|
* Connect manager
|
|
|
|
*/
|
|
|
|
connect_manager_t *connect_manager;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2007-10-03 15:10:41 +00:00
|
|
|
/**
|
|
|
|
* Mediation manager
|
|
|
|
*/
|
|
|
|
mediation_manager_t *mediation_manager;
|
2008-03-26 18:40:19 +00:00
|
|
|
#endif /* ME */
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2008-05-08 10:58:04 +00:00
|
|
|
/**
|
|
|
|
* User ID the daemon will user after initialization
|
|
|
|
*/
|
|
|
|
uid_t uid;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Group ID the daemon will use after initialization
|
|
|
|
*/
|
|
|
|
gid_t gid;
|
2009-09-04 11:46:09 +00:00
|
|
|
|
2008-08-28 16:27:48 +00:00
|
|
|
/**
|
|
|
|
* Do not drop a given capability after initialization.
|
|
|
|
*
|
|
|
|
* Some plugins might need additional capabilites. They tell the daemon
|
|
|
|
* during plugin initialization which one they need, the daemon won't
|
|
|
|
* drop these.
|
|
|
|
*/
|
|
|
|
void (*keep_cap)(daemon_t *this, u_int cap);
|
2010-03-12 15:56:54 +00:00
|
|
|
|
|
|
|
/**
|
2010-03-25 13:54:56 +00:00
|
|
|
* Drop all capabilities of the current process.
|
2010-03-12 15:56:54 +00:00
|
|
|
*
|
2010-03-25 13:54:56 +00:00
|
|
|
* Drops all capabalities, excect those exlcuded using keep_cap().
|
2010-03-12 15:56:54 +00:00
|
|
|
* This should be called after the initialization of the daemon because
|
|
|
|
* some plugins require the process to keep additional capabilities.
|
|
|
|
*
|
2012-04-19 11:32:51 +00:00
|
|
|
* @return TRUE, if successful
|
2010-03-12 15:56:54 +00:00
|
|
|
*/
|
|
|
|
bool (*drop_capabilities)(daemon_t *this);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Initialize the daemon.
|
2012-04-19 11:32:51 +00:00
|
|
|
*
|
|
|
|
* @param plugins list of plugins to load
|
|
|
|
* @return TRUE, if successful
|
2010-03-12 15:56:54 +00:00
|
|
|
*/
|
2012-04-19 11:32:51 +00:00
|
|
|
bool (*initialize)(daemon_t *this, char *plugins);
|
2010-03-12 15:56:54 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Starts the daemon, i.e. spawns the threads of the thread pool.
|
|
|
|
*/
|
|
|
|
void (*start)(daemon_t *this);
|
|
|
|
|
2005-11-29 10:25:07 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
/**
|
2010-03-25 13:54:56 +00:00
|
|
|
* The one and only instance of the daemon.
|
|
|
|
*
|
|
|
|
* Set between libcharon_init() and libcharon_deinit() calls.
|
2005-11-29 10:25:07 +00:00
|
|
|
*/
|
|
|
|
extern daemon_t *charon;
|
2005-11-11 11:20:45 +00:00
|
|
|
|
2010-03-12 15:56:54 +00:00
|
|
|
/**
|
|
|
|
* Initialize libcharon and create the "charon" instance of daemon_t.
|
2010-03-25 13:54:56 +00:00
|
|
|
*
|
2010-10-29 07:39:19 +00:00
|
|
|
* This function initializes the bus, listeners can be registered before
|
|
|
|
* calling initialize().
|
|
|
|
*
|
2010-03-12 15:56:54 +00:00
|
|
|
* @return FALSE if integrity check failed
|
|
|
|
*/
|
|
|
|
bool libcharon_init();
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Deinitialize libcharon and destroy the "charon" instance of daemon_t.
|
|
|
|
*/
|
|
|
|
void libcharon_deinit();
|
|
|
|
|
2009-03-24 17:43:01 +00:00
|
|
|
#endif /** DAEMON_H_ @}*/
|