use MAX_RADIUS_ATTRIBUTE_SIZE constant from radius_message header file
[strongswan.git] / doc / architecture.h
1 /** @mainpage
2
3 @section design strongSwans overall design
4
5 IKEv1 and IKEv2 is handled in different keying daemons. The ole IKEv1 stuff is
6 completely handled in pluto, as it was all the times. IKEv2 is handled in the
7 new keying daemon, which is called #charon.
8 Daemon control is done over unix sockets. Pluto uses whack, as it did for years.
9 Charon uses another socket interface, called stroke. Stroke uses another
10 format as whack and therefore is not compatible to whack. The starter utility,
11 which does fast configuration parsing, speaks both the protocols, whack and
12 stroke. It also handles daemon startup and termination.
13 Pluto uses starter for some commands, for other it uses the whack utility. To be
14 as close to pluto as possible, charon has the same split up of commands to
15 starter and stroke. All commands are wrapped together in the ipsec script, which
16 allows transparent control of both daemons.
17 @verbatim
18
19 +-----------------------------------------+
20 | ipsec |
21 +-----+--------------+---------------+----+
22 | | |
23 | | |
24 | +-----+-----+ |
25 +-----+----+ | | +-----+----+
26 | | | starter | | |
27 | stroke | | | | whack |
28 | | +---+--+----+ | |
29 +------+---+ | | +--+-------+
30 | | | |
31 +---+------+ | | +------+--+
32 | | | | | |
33 | charon +----+ +----+ pluto |
34 | | | |
35 +-----+----+ +----+----+
36 | |
37 +-----+----+ |
38 | LSF | |
39 +-----+----+ |
40 | |
41 +-----+----+ +----+----+
42 | RAW Sock | | UDP/500 |
43 +----------+ +---------+
44
45 @endverbatim
46 Since IKEv2 uses the same port as IKEv1, both daemons must listen to UDP port
47 500. Under Linux, there is no clean way to set up two sockets at the same port.
48 To reslove this problem, charon uses a RAW socket, as they are used in network
49 sniffers. An installed Linux Socket Filter (LSF) filters out all none-IKEv2
50 traffic. Pluto receives any IKE message, independent of charon's behavior.
51 Therefore plutos behavior is changed to discard any IKEv2 traffic silently.
52
53 To gain some reusability of the code, generic crypto and utility functions are
54 separeted in a shared library, libstrongswan.
55
56 */