src/charon/daemon.h

   1 /*
   2  * Copyright (C) 2006-2007 Tobias Brunner
   3  * Copyright (C) 2006 Daniel Roethlisberger
   4  * Copyright (C) 2005-2008 Martin Willi
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  *
  18  * $Id$
  19  */
  20
  21 /**
  22  * @defgroup charon charon
  23  *
  24  * @defgroup bus bus
  25  * @ingroup charon
  26  *
  27  * @defgroup listeners listeners
  28  * @ingroup bus
  29  *
  30  * @defgroup config config
  31  * @ingroup charon
  32  *
  33  * @defgroup attributes attributes
  34  * @ingroup config
  35  *
  36  * @defgroup control control
  37  * @ingroup charon
  38  *
  39  * @defgroup ccredentials credentials
  40  * @ingroup charon
  41  *
  42  * @defgroup sets sets
  43  * @ingroup ccredentials
  44  *
  45  * @defgroup encoding encoding
  46  * @ingroup charon
  47  *
  48  * @defgroup payloads payloads
  49  * @ingroup encoding
  50  *
  51  * @defgroup kernel kernel
  52  * @ingroup charon
  53  *
  54  * @defgroup network network
  55  * @ingroup charon
  56  *
  57  * @defgroup cplugins plugins
  58  * @ingroup charon
  59  *
  60  * @defgroup processing processing
  61  * @ingroup charon
  62  *
  63  * @defgroup jobs jobs
  64  * @ingroup processing
  65  *
  66  * @defgroup sa sa
  67  * @ingroup charon
  68  *
  69  * @defgroup authenticators authenticators
  70  * @ingroup sa
  71  *
  72  * @defgroup eap eap
  73  * @ingroup authenticators
  74  *
  75  * @defgroup tasks tasks
  76  * @ingroup sa
  77  *
  78  * @addtogroup charon
  79  * @{
  80  *
  81  * IKEv2 keying daemon.
  82  *
  83  * All IKEv2 stuff is handled in charon. It uses a newer and more flexible
  84  * architecture than pluto. Charon uses a thread-pool (called processor),
  85  * which allows parallel execution SA-management. All threads originate
  86  * from the processor. Work is delegated to the processor by queueing jobs
  87  * to it.
  88    @verbatim
  89
  90       +---------------------------------+       +----------------------------+
  91       |           controller            |       |          config            |
  92       +---------------------------------+       +----------------------------+
  93                |      |      |                           ^     ^    ^
  94                V      V      V                           |     |    |
  95
  96        +----------+  +-----------+   +------+            +----------+    +----+
  97        | receiver |  |           |   |      |  +------+  | CHILD_SA |    | K  |
  98        +---+------+  | Scheduler |   | IKE- |  | IKE- |--+----------+    | e  |
  99            |         |           |   | SA   |--| SA   |  | CHILD_SA |    | r  |
 100     +------+---+     +-----------+   |      |  +------+  +----------+    | n  |
 101  <->|  socket  |           |         | Man- |                            | e  |
 102     +------+---+     +-----------+   | ager |  +------+  +----------+    | l  |
 103            |         |           |   |      |  | IKE- |--| CHILD_SA |    | -  |
 104        +---+------+  | Processor |---|      |--| SA   |  +----------+    | I  |
 105        |  sender  |  |           |   |      |  +------+                  | f  |
 106        +----------+  +-----------+   +------+                            +----+
 107
 108                |      |      |                        |      |      |
 109                V      V      V                        V      V      V
 110       +---------------------------------+       +----------------------------+
 111       |               Bus               |       |         credentials        |
 112       +---------------------------------+       +----------------------------+
 113
 114    @endverbatim
 115  * The scheduler is responsible to execute timed events. Jobs may be queued to
 116  * the scheduler to get executed at a defined time (e.g. rekeying). The
 117  * scheduler does not execute the jobs itself, it queues them to the processor.
 118  *
 119  * The IKE_SA manager managers all IKE_SA. It further handles the
 120  * synchronization:
 121  * Each IKE_SA must be checked out strictly and checked in again after use. The
 122  * manager guarantees that only one thread may check out a single IKE_SA. This
 123  * allows us to write the (complex) IKE_SAs routines non-threadsave.
 124  * The IKE_SA contain the state and the logic of each IKE_SA and handle the
 125  * messages.
 126  *
 127  * The CHILD_SA contains state about a IPsec security association and manages
 128  * them. An IKE_SA may have multiple CHILD_SAs. Communication to the kernel
 129  * takes place here through the kernel interface.
 130  *
 131  * The kernel interface installs IPsec security associations, policies, routes
 132  * and virtual addresses. It further provides methods to enumerate interfaces
 133  * and may notify the daemon about state changes at lower layers.
 134  *
 135  * The bus receives signals from the different threads and relais them to interested
 136  * listeners. Debugging signals, but also important state changes or error
 137  * messages are sent over the bus.
 138  * It's listeners are not only for logging, but also to track the state of an
 139  * IKE_SA.
 140  *
 141  * The controller, credential_manager, bus and backend_manager (config) are
 142  * places where a plugin ca register itself to privide information or observe
 143  * and control the daemon.
 144  */
 145
 146 #ifndef DAEMON_H_
 147 #define DAEMON_H_
 148
 149 typedef struct daemon_t daemon_t;
 150
 151 #include <network/sender.h>
 152 #include <network/receiver.h>
 153 #include <network/socket.h>
 154 #include <processing/scheduler.h>
 155 #include <processing/processor.h>
 156 #include <kernel/kernel_interface.h>
 157 #include <control/controller.h>
 158 #include <bus/bus.h>
 159 #include <bus/listeners/file_logger.h>
 160 #include <bus/listeners/sys_logger.h>
 161 #include <sa/ike_sa_manager.h>
 162 #include <config/backend_manager.h>
 163 #include <config/attributes/attribute_manager.h>
 164 #include <credentials/credential_manager.h>
 165 #include <sa/authenticators/eap/eap_manager.h>
 166
 167 #ifdef ME
 168 #include <sa/connect_manager.h>
 169 #include <sa/mediation_manager.h>
 170 #endif /* ME */
 171
 172 /**
 173  * Name of the daemon.
 174  */
 175 #define DAEMON_NAME "charon"
 176
 177 /**
 178  * Number of threads in the thread pool, if not specified in config.
 179  */
 180 #define DEFAULT_THREADS 16
 181
 182 /**
 183  * UDP Port on which the daemon will listen for incoming traffic.
 184  */
 185 #define IKEV2_UDP_PORT 500
 186
 187 /**
 188  * UDP Port to which the daemon will float to if NAT is detected.
 189  */
 190 #define IKEV2_NATT_PORT 4500
 191
 192 /**
 193  * PID file, in which charon stores its process id
 194  */
 195 #define PID_FILE IPSEC_PIDDIR "/charon.pid"
 196
 197
 198 /**
 199  * Main class of daemon, contains some globals.
 200  */
 201 struct daemon_t {
 202
 203         /**
 204          * A socket_t instance.
 205          */
 206         socket_t *socket;
 207
 208         /**
 209          * A ike_sa_manager_t instance.
 210          */
 211         ike_sa_manager_t *ike_sa_manager;
 212
 213         /**
 214          * Manager for the different configuration backends.
 215          */
 216         backend_manager_t *backends;
 217
 218         /**
 219          * Manager IKEv2 cfg payload attributes
 220          */
 221         attribute_manager_t *attributes;
 222
 223         /**
 224          * Manager for the credential backends
 225          */
 226         credential_manager_t *credentials;
 227
 228         /**
 229          * The Sender-Thread.
 230          */
 231         sender_t *sender;
 232
 233         /**
 234          * The Receiver-Thread.
 235          */
 236         receiver_t *receiver;
 237
 238         /**
 239          * The Scheduler-Thread.
 240          */
 241         scheduler_t *scheduler;
 242
 243         /**
 244          * Job processing using a thread pool.
 245          */
 246         processor_t *processor;
 247
 248         /**
 249          * The signaling bus.
 250          */
 251         bus_t *bus;
 252
 253         /**
 254          * A bus listener logging to stdout
 255          */
 256         file_logger_t *outlog;
 257
 258         /**
 259          * A bus listener logging to syslog
 260          */
 261         sys_logger_t *syslog;
 262
 263         /**
 264          * A bus listener logging most important events
 265          */
 266         sys_logger_t *authlog;
 267
 268         /**
 269          * Kernel Interface to communicate with kernel
 270          */
 271         kernel_interface_t *kernel_interface;
 272
 273         /**
 274          * Controller to control the daemon
 275          */
 276         controller_t *controller;
 277
 278         /**
 279          * EAP manager to maintain registered EAP methods
 280          */
 281         eap_manager_t *eap;
 282
 283 #ifdef ME
 284         /**
 285          * Connect manager
 286          */
 287         connect_manager_t *connect_manager;
 288
 289         /**
 290          * Mediation manager
 291          */
 292         mediation_manager_t *mediation_manager;
 293 #endif /* ME */
 294
 295         /**
 296          * User ID the daemon will user after initialization
 297          */
 298         uid_t uid;
 299
 300         /**
 301          * Group ID the daemon will use after initialization
 302          */
 303         gid_t gid;
 304
 305         /**
 306          * Do not drop a given capability after initialization.
 307          *
 308          * Some plugins might need additional capabilites. They tell the daemon
 309          * during plugin initialization which one they need, the daemon won't
 310          * drop these.
 311          */
 312         void (*keep_cap)(daemon_t *this, u_int cap);
 313
 314         /**
 315          * Shut down the daemon.
 316          *
 317          * @param reason                describtion why it will be killed
 318          */
 319         void (*kill) (daemon_t *this, char *reason);
 320 };
 321
 322 /**
 323  * The one and only instance of the daemon.
 324  */
 325 extern daemon_t *charon;
 326
 327 #endif /*DAEMON_H_ @} */