libhydra: Move kernel interface to libcharon
[strongswan.git] / src / libcharon / daemon.h
1 /*
2 * Copyright (C) 2006-2012 Tobias Brunner
3 * Copyright (C) 2005-2009 Martin Willi
4 * Copyright (C) 2006 Daniel Roethlisberger
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 /*
20 * Copyright (C) 2016 secunet Security Networks AG
21 * Copyright (C) 2016 Thomas Egerer
22 *
23 * Permission is hereby granted, free of charge, to any person obtaining a copy
24 * of this software and associated documentation files (the "Software"), to deal
25 * in the Software without restriction, including without limitation the rights
26 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
27 * copies of the Software, and to permit persons to whom the Software is
28 * furnished to do so, subject to the following conditions:
29 *
30 * The above copyright notice and this permission notice shall be included in
31 * all copies or substantial portions of the Software.
32 *
33 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
34 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
35 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
36 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
37 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
38 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
39 * THE SOFTWARE.
40 */
41
42 /**
43 * @defgroup libcharon libcharon
44 *
45 * @defgroup attributes attributes
46 * @ingroup libcharon
47 *
48 * @defgroup bus bus
49 * @ingroup libcharon
50 *
51 * @defgroup listeners listeners
52 * @ingroup bus
53 *
54 * @defgroup config config
55 * @ingroup libcharon
56 *
57 * @defgroup control control
58 * @ingroup libcharon
59 *
60 * @defgroup encoding encoding
61 * @ingroup libcharon
62 *
63 * @defgroup payloads payloads
64 * @ingroup encoding
65 *
66 * @defgroup kernel kernel
67 * @ingroup libcharon
68 *
69 * @defgroup network network
70 * @ingroup libcharon
71 *
72 * @defgroup cplugins plugins
73 * @ingroup libcharon
74 *
75 * @defgroup cprocessing processing
76 * @ingroup libcharon
77 *
78 * @defgroup cjobs jobs
79 * @ingroup cprocessing
80 *
81 * @defgroup sa sa
82 * @ingroup libcharon
83 *
84 * @defgroup ikev1 ikev1
85 * @ingroup sa
86 *
87 * @defgroup ikev2 ikev2
88 * @ingroup sa
89 *
90 * @defgroup authenticators_v1 authenticators
91 * @ingroup ikev1
92 *
93 * @defgroup authenticators_v2 authenticators
94 * @ingroup ikev2
95 *
96 * @defgroup eap eap
97 * @ingroup sa
98 *
99 * @defgroup xauth xauth
100 * @ingroup sa
101 *
102 * @defgroup tasks_v1 tasks
103 * @ingroup ikev1
104 *
105 * @defgroup tasks_v2 tasks
106 * @ingroup ikev2
107 *
108 * @addtogroup libcharon
109 * @{
110 *
111 * IKEv2 keying daemon.
112 *
113 * All IKEv2 stuff is handled in charon. It uses a newer and more flexible
114 * architecture than pluto. Charon uses a thread-pool (called processor),
115 * which allows parallel execution SA-management. All threads originate
116 * from the processor. Work is delegated to the processor by queueing jobs
117 * to it.
118 @verbatim
119
120 +---------------------------------+ +----------------------------+
121 | controller | | config |
122 +---------------------------------+ +----------------------------+
123 | | | ^ ^ ^
124 V V V | | |
125
126 +----------+ +-----------+ +------+ +----------+ +----+
127 | receiver | | | | | +------+ | CHILD_SA | | K |
128 +---+------+ | Scheduler | | IKE- | | IKE- |--+----------+ | e |
129 | | | | SA |--| SA | | CHILD_SA | | r |
130 +------+---+ +-----------+ | | +------+ +----------+ | n |
131 <->| socket | | | Man- | | e |
132 +------+---+ +-----------+ | ager | +------+ +----------+ | l |
133 | | | | | | IKE- |--| CHILD_SA | | - |
134 +---+------+ | Processor |---| |--| SA | +----------+ | I |
135 | sender | | | | | +------+ | f |
136 +----------+ +-----------+ +------+ +----+
137
138 | | | | | |
139 V V V V V V
140 +---------------------------------+ +----------------------------+
141 | Bus | | credentials |
142 +---------------------------------+ +----------------------------+
143
144 @endverbatim
145 * The scheduler is responsible to execute timed events. Jobs may be queued to
146 * the scheduler to get executed at a defined time (e.g. rekeying). The
147 * scheduler does not execute the jobs itself, it queues them to the processor.
148 *
149 * The IKE_SA manager managers all IKE_SA. It further handles the
150 * synchronization:
151 * Each IKE_SA must be checked out strictly and checked in again after use. The
152 * manager guarantees that only one thread may check out a single IKE_SA. This
153 * allows us to write the (complex) IKE_SAs routines non-threadsave.
154 * The IKE_SA contain the state and the logic of each IKE_SA and handle the
155 * messages.
156 *
157 * The CHILD_SA contains state about a IPsec security association and manages
158 * them. An IKE_SA may have multiple CHILD_SAs. Communication to the kernel
159 * takes place here through the kernel interface.
160 *
161 * The kernel interface installs IPsec security associations, policies, routes
162 * and virtual addresses. It further provides methods to enumerate interfaces
163 * and may notify the daemon about state changes at lower layers.
164 *
165 * The bus receives signals from the different threads and relays them to
166 * interested listeners. Debugging signals, but also important state changes or
167 * error messages are sent over the bus.
168 * Its listeners are not only for logging, but also to track the state of an
169 * IKE_SA.
170 *
171 * The controller, credential_manager, bus and backend_manager (config) are
172 * places where a plugin ca register itself to privide information or observe
173 * and control the daemon.
174 */
175
176 #ifndef DAEMON_H_
177 #define DAEMON_H_
178
179 typedef struct daemon_t daemon_t;
180
181 #include <attributes/attribute_manager.h>
182 #include <kernel/kernel_interface.h>
183 #include <network/sender.h>
184 #include <network/receiver.h>
185 #include <network/socket_manager.h>
186 #include <control/controller.h>
187 #include <bus/bus.h>
188 #include <bus/listeners/custom_logger.h>
189 #include <sa/ike_sa_manager.h>
190 #include <sa/child_sa_manager.h>
191 #include <sa/trap_manager.h>
192 #include <sa/shunt_manager.h>
193 #include <config/backend_manager.h>
194 #include <sa/eap/eap_manager.h>
195 #include <sa/xauth/xauth_manager.h>
196
197 #ifdef ME
198 #include <sa/ikev2/connect_manager.h>
199 #include <sa/ikev2/mediation_manager.h>
200 #endif /* ME */
201
202 /**
203 * Number of threads in the thread pool, if not specified in config.
204 */
205 #define DEFAULT_THREADS 16
206
207 /**
208 * Primary UDP port used by IKE.
209 */
210 #define IKEV2_UDP_PORT 500
211
212 /**
213 * UDP port defined for use in case a NAT is detected.
214 */
215 #define IKEV2_NATT_PORT 4500
216
217 /**
218 * UDP port on which the daemon will listen for incoming traffic (also used as
219 * source port for outgoing traffic).
220 */
221 #ifndef CHARON_UDP_PORT
222 #define CHARON_UDP_PORT IKEV2_UDP_PORT
223 #endif
224
225 /**
226 * UDP port used by the daemon in case a NAT is detected.
227 */
228 #ifndef CHARON_NATT_PORT
229 #define CHARON_NATT_PORT IKEV2_NATT_PORT
230 #endif
231
232 /**
233 * Main class of daemon, contains some globals.
234 */
235 struct daemon_t {
236
237 /**
238 * Socket manager instance
239 */
240 socket_manager_t *socket;
241
242 /**
243 * Kernel interface to communicate with kernel
244 */
245 kernel_interface_t *kernel;
246
247 /**
248 * A ike_sa_manager_t instance.
249 */
250 ike_sa_manager_t *ike_sa_manager;
251
252 /**
253 * A child_sa_manager_t instance.
254 */
255 child_sa_manager_t *child_sa_manager;
256
257 /**
258 * Manager for triggering policies, called traps
259 */
260 trap_manager_t *traps;
261
262 /**
263 * Manager for shunt PASS|DROP policies
264 */
265 shunt_manager_t *shunts;
266
267 /**
268 * Manager for the different configuration backends.
269 */
270 backend_manager_t *backends;
271
272 /**
273 * The Sender-Thread.
274 */
275 sender_t *sender;
276
277 /**
278 * The Receiver-Thread.
279 */
280 receiver_t *receiver;
281
282 /**
283 * Manager for IKE configuration attributes
284 */
285 attribute_manager_t *attributes;
286
287 /**
288 * The signaling bus.
289 */
290 bus_t *bus;
291
292 /**
293 * Controller to control the daemon
294 */
295 controller_t *controller;
296
297 /**
298 * EAP manager to maintain registered EAP methods
299 */
300 eap_manager_t *eap;
301
302 /**
303 * XAuth manager to maintain registered XAuth methods
304 */
305 xauth_manager_t *xauth;
306
307 #ifdef ME
308 /**
309 * Connect manager
310 */
311 connect_manager_t *connect_manager;
312
313 /**
314 * Mediation manager
315 */
316 mediation_manager_t *mediation_manager;
317 #endif /* ME */
318
319 /**
320 * Initialize the daemon.
321 *
322 * @param plugins list of plugins to load
323 * @return TRUE, if successful
324 */
325 bool (*initialize)(daemon_t *this, char *plugins);
326
327 /**
328 * Starts the daemon, i.e. spawns the threads of the thread pool.
329 */
330 void (*start)(daemon_t *this);
331
332 /**
333 * Load/Reload loggers defined in strongswan.conf
334 *
335 * @param levels optional debug levels used to create default loggers
336 * if none are defined in strongswan.conf
337 * @param to_stderr TRUE to log to stderr/stdout if no loggers are defined
338 * in strongswan.conf
339 */
340 void (*load_loggers)(daemon_t *this, level_t levels[DBG_MAX],
341 bool to_stderr);
342
343 /**
344 * Set the log level for the given log group for all configured file-,
345 * syslog and custom-loggers.
346 *
347 * @param group log group
348 * @param level log level
349 */
350 void (*set_level)(daemon_t *this, debug_t group, level_t level);
351 };
352
353 /**
354 * The one and only instance of the daemon.
355 *
356 * Set between libcharon_init() and libcharon_deinit() calls.
357 */
358 extern daemon_t *charon;
359
360 /**
361 * Initialize libcharon and create the "charon" instance of daemon_t.
362 *
363 * This function initializes the bus, listeners can be registered before
364 * calling initialize().
365 *
366 * libcharon_init() may be called multiple times in a single process, but each
367 * caller must call libcharon_deinit() for each call to libcharon_init().
368 *
369 * @return FALSE if integrity check failed
370 */
371 bool libcharon_init();
372
373 /**
374 * Deinitialize libcharon and destroy the "charon" instance of daemon_t.
375 */
376 void libcharon_deinit();
377
378 /**
379 * Register a custom logger constructor.
380 *
381 * To be called from __attribute__((constructor)) functions.
382 *
383 * @param name name of the logger (also used for loglevel config)
384 * @param constructor constructor to create custom logger
385 */
386 void register_custom_logger(char *name,
387 custom_logger_constructor_t constructor);
388
389 #endif /** DAEMON_H_ @}*/