Fixing Doxygen groups after moving processor.
[strongswan.git] / src / libcharon / daemon.h
1 /*
2 * Copyright (C) 2006-2010 Tobias Brunner
3 * Copyright (C) 2005-2009 Martin Willi
4 * Copyright (C) 2006 Daniel Roethlisberger
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 /**
20 * @defgroup libcharon libcharon
21 *
22 * @defgroup bus bus
23 * @ingroup libcharon
24 *
25 * @defgroup listeners listeners
26 * @ingroup bus
27 *
28 * @defgroup config config
29 * @ingroup libcharon
30 *
31 * @defgroup control control
32 * @ingroup libcharon
33 *
34 * @defgroup encoding encoding
35 * @ingroup libcharon
36 *
37 * @defgroup payloads payloads
38 * @ingroup encoding
39 *
40 * @defgroup kernel kernel
41 * @ingroup libcharon
42 *
43 * @defgroup network network
44 * @ingroup libcharon
45 *
46 * @defgroup cplugins plugins
47 * @ingroup libcharon
48 *
49 * @defgroup cprocessing processing
50 * @ingroup libcharon
51 *
52 * @defgroup cjobs jobs
53 * @ingroup cprocessing
54 *
55 * @defgroup sa sa
56 * @ingroup libcharon
57 *
58 * @defgroup authenticators authenticators
59 * @ingroup sa
60 *
61 * @defgroup eap eap
62 * @ingroup authenticators
63 *
64 * @defgroup tasks tasks
65 * @ingroup sa
66 *
67 * @addtogroup libcharon
68 * @{
69 *
70 * IKEv2 keying daemon.
71 *
72 * All IKEv2 stuff is handled in charon. It uses a newer and more flexible
73 * architecture than pluto. Charon uses a thread-pool (called processor),
74 * which allows parallel execution SA-management. All threads originate
75 * from the processor. Work is delegated to the processor by queueing jobs
76 * to it.
77 @verbatim
78
79 +---------------------------------+ +----------------------------+
80 | controller | | config |
81 +---------------------------------+ +----------------------------+
82 | | | ^ ^ ^
83 V V V | | |
84
85 +----------+ +-----------+ +------+ +----------+ +----+
86 | receiver | | | | | +------+ | CHILD_SA | | K |
87 +---+------+ | Scheduler | | IKE- | | IKE- |--+----------+ | e |
88 | | | | SA |--| SA | | CHILD_SA | | r |
89 +------+---+ +-----------+ | | +------+ +----------+ | n |
90 <->| socket | | | Man- | | e |
91 +------+---+ +-----------+ | ager | +------+ +----------+ | l |
92 | | | | | | IKE- |--| CHILD_SA | | - |
93 +---+------+ | Processor |---| |--| SA | +----------+ | I |
94 | sender | | | | | +------+ | f |
95 +----------+ +-----------+ +------+ +----+
96
97 | | | | | |
98 V V V V V V
99 +---------------------------------+ +----------------------------+
100 | Bus | | credentials |
101 +---------------------------------+ +----------------------------+
102
103 @endverbatim
104 * The scheduler is responsible to execute timed events. Jobs may be queued to
105 * the scheduler to get executed at a defined time (e.g. rekeying). The
106 * scheduler does not execute the jobs itself, it queues them to the processor.
107 *
108 * The IKE_SA manager managers all IKE_SA. It further handles the
109 * synchronization:
110 * Each IKE_SA must be checked out strictly and checked in again after use. The
111 * manager guarantees that only one thread may check out a single IKE_SA. This
112 * allows us to write the (complex) IKE_SAs routines non-threadsave.
113 * The IKE_SA contain the state and the logic of each IKE_SA and handle the
114 * messages.
115 *
116 * The CHILD_SA contains state about a IPsec security association and manages
117 * them. An IKE_SA may have multiple CHILD_SAs. Communication to the kernel
118 * takes place here through the kernel interface.
119 *
120 * The kernel interface installs IPsec security associations, policies, routes
121 * and virtual addresses. It further provides methods to enumerate interfaces
122 * and may notify the daemon about state changes at lower layers.
123 *
124 * The bus receives signals from the different threads and relays them to
125 * interested listeners. Debugging signals, but also important state changes or
126 * error messages are sent over the bus.
127 * Its listeners are not only for logging, but also to track the state of an
128 * IKE_SA.
129 *
130 * The controller, credential_manager, bus and backend_manager (config) are
131 * places where a plugin ca register itself to privide information or observe
132 * and control the daemon.
133 */
134
135 #ifndef DAEMON_H_
136 #define DAEMON_H_
137
138 typedef struct daemon_t daemon_t;
139
140 #include <network/sender.h>
141 #include <network/receiver.h>
142 #include <network/socket_manager.h>
143 #include <processing/scheduler.h>
144 #include <kernel/kernel_interface.h>
145 #include <control/controller.h>
146 #include <bus/bus.h>
147 #include <bus/listeners/file_logger.h>
148 #include <bus/listeners/sys_logger.h>
149 #include <sa/ike_sa_manager.h>
150 #include <sa/trap_manager.h>
151 #include <config/backend_manager.h>
152 #include <sa/authenticators/eap/eap_manager.h>
153 #include <sa/authenticators/eap/sim_manager.h>
154
155 #ifdef ME
156 #include <sa/connect_manager.h>
157 #include <sa/mediation_manager.h>
158 #endif /* ME */
159
160 /**
161 * Number of threads in the thread pool, if not specified in config.
162 */
163 #define DEFAULT_THREADS 16
164
165 /**
166 * UDP Port on which the daemon will listen for incoming traffic.
167 */
168 #define IKEV2_UDP_PORT 500
169
170 /**
171 * UDP Port to which the daemon will float to if NAT is detected.
172 */
173 #define IKEV2_NATT_PORT 4500
174
175 /**
176 * Main class of daemon, contains some globals.
177 */
178 struct daemon_t {
179
180 /**
181 * Socket manager instance
182 */
183 socket_manager_t *socket;
184
185 /**
186 * A ike_sa_manager_t instance.
187 */
188 ike_sa_manager_t *ike_sa_manager;
189
190 /**
191 * Manager for triggering policies, called traps
192 */
193 trap_manager_t *traps;
194
195 /**
196 * Manager for the different configuration backends.
197 */
198 backend_manager_t *backends;
199
200 /**
201 * The Sender-Thread.
202 */
203 sender_t *sender;
204
205 /**
206 * The Receiver-Thread.
207 */
208 receiver_t *receiver;
209
210 /**
211 * The Scheduler-Thread.
212 */
213 scheduler_t *scheduler;
214
215 /**
216 * The signaling bus.
217 */
218 bus_t *bus;
219
220 /**
221 * A list of installed file_logger_t's
222 */
223 linked_list_t *file_loggers;
224
225 /**
226 * A list of installed sys_logger_t's
227 */
228 linked_list_t *sys_loggers;
229
230 /**
231 * Kernel Interface to communicate with kernel
232 */
233 kernel_interface_t *kernel_interface;
234
235 /**
236 * Controller to control the daemon
237 */
238 controller_t *controller;
239
240 /**
241 * EAP manager to maintain registered EAP methods
242 */
243 eap_manager_t *eap;
244
245 /**
246 * SIM manager to maintain (U)SIM cards/providers
247 */
248 sim_manager_t *sim;
249
250 #ifdef ME
251 /**
252 * Connect manager
253 */
254 connect_manager_t *connect_manager;
255
256 /**
257 * Mediation manager
258 */
259 mediation_manager_t *mediation_manager;
260 #endif /* ME */
261
262 /**
263 * User ID the daemon will user after initialization
264 */
265 uid_t uid;
266
267 /**
268 * Group ID the daemon will use after initialization
269 */
270 gid_t gid;
271
272 /**
273 * Do not drop a given capability after initialization.
274 *
275 * Some plugins might need additional capabilites. They tell the daemon
276 * during plugin initialization which one they need, the daemon won't
277 * drop these.
278 */
279 void (*keep_cap)(daemon_t *this, u_int cap);
280
281 /**
282 * Drop all capabilities of the current process.
283 *
284 * Drops all capabalities, excect those exlcuded using keep_cap().
285 * This should be called after the initialization of the daemon because
286 * some plugins require the process to keep additional capabilities.
287 *
288 * @return TRUE if successful, FALSE otherwise
289 */
290 bool (*drop_capabilities)(daemon_t *this);
291
292 /**
293 * Initialize the daemon.
294 */
295 bool (*initialize)(daemon_t *this, bool syslog, level_t levels[]);
296
297 /**
298 * Starts the daemon, i.e. spawns the threads of the thread pool.
299 */
300 void (*start)(daemon_t *this);
301
302 };
303
304 /**
305 * The one and only instance of the daemon.
306 *
307 * Set between libcharon_init() and libcharon_deinit() calls.
308 */
309 extern daemon_t *charon;
310
311 /**
312 * Initialize libcharon and create the "charon" instance of daemon_t.
313 *
314 * @return FALSE if integrity check failed
315 */
316 bool libcharon_init();
317
318 /**
319 * Deinitialize libcharon and destroy the "charon" instance of daemon_t.
320 */
321 void libcharon_deinit();
322
323 #endif /** DAEMON_H_ @}*/