src/starter/starter.c

   1 /* strongSwan IPsec starter
   2  * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
   3  *
   4  * This program is free software; you can redistribute it and/or modify it
   5  * under the terms of the GNU General Public License as published by the
   6  * Free Software Foundation; either version 2 of the License, or (at your
   7  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   8  *
   9  * This program is distributed in the hope that it will be useful, but
  10  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  11  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * for more details.
  13  *
  14  * RCSID $Id: starter.c,v 1.23 2006/02/15 18:37:46 as Exp $
  15  */
  16
  17 #include <sys/types.h>
  18 #include <sys/wait.h>
  19 #include <sys/stat.h>
  20 #include <stdlib.h>
  21 #include <stdio.h>
  22 #include <signal.h>
  23 #include <unistd.h>
  24 #include <sys/time.h>
  25 #include <time.h>
  26 #include <string.h>
  27 #include <errno.h>
  28 #include <fcntl.h>
  29
  30 #include <freeswan.h>
  31
  32 #include "../pluto/constants.h"
  33 #include "../pluto/defs.h"
  34 #include "../pluto/log.h"
  35
  36 #include "confread.h"
  37 #include "files.h"
  38 #include "starterwhack.h"
  39 #include "starterstroke.h"
  40 #include "invokepluto.h"
  41 #include "invokecharon.h"
  42 #include "netkey.h"
  43 #include "cmp.h"
  44 #include "interfaces.h"
  45
  46 #define FLAG_ACTION_START_PLUTO   0x01
  47 #define FLAG_ACTION_UPDATE        0x02
  48 #define FLAG_ACTION_RELOAD        0x04
  49 #define FLAG_ACTION_QUIT          0x08
  50 #define FLAG_ACTION_LISTEN        0x10
  51 #define FLAG_ACTION_START_CHARON  0x20
  52
  53 static unsigned int _action_ = 0;
  54
  55 static void
  56 fsig(int signal)
  57 {
  58     switch (signal)
  59     {
  60         case SIGCHLD:
  61         {
  62             int status;
  63             pid_t pid;
  64             char *name = NULL;
  65
  66             while ((pid = waitpid(-1, &status, WNOHANG)) > 0)
  67             {
  68                 if (pid == starter_pluto_pid())
  69                     name = " (Pluto)";
  70                 if (pid == starter_charon_pid())
  71                     name = " (Charon)";
  72                 if (WIFSIGNALED(status))
  73                     DBG(DBG_CONTROL,
  74                         DBG_log("child %d%s has been killed by sig %d\n",
  75                                 pid, name?name:"", WTERMSIG(status))
  76                        )
  77                 else if (WIFSTOPPED(status))
  78                     DBG(DBG_CONTROL,
  79                         DBG_log("child %d%s has been stopped by sig %d\n",
  80                                 pid, name?name:"", WSTOPSIG(status))
  81                        )
  82                 else if (WIFEXITED(status))
  83                     DBG(DBG_CONTROL,
  84                         DBG_log("child %d%s has quit (exit code %d)\n",
  85                                 pid, name?name:"", WEXITSTATUS(status))
  86                        )
  87                 else
  88                     DBG(DBG_CONTROL,
  89                         DBG_log("child %d%s has quit", pid, name?name:"")
  90                        )
  91                 if (pid == starter_pluto_pid())
  92                     starter_pluto_sigchild(pid);
  93                 if (pid == starter_charon_pid())
  94                     starter_charon_sigchild(pid);
  95             }
  96         }
  97         break;
  98
  99         case SIGPIPE:
 100             /** ignore **/
 101             break;
 102
 103         case SIGALRM:
 104             _action_ |= FLAG_ACTION_START_PLUTO;
 105             _action_ |= FLAG_ACTION_START_CHARON;
 106             break;
 107
 108         case SIGHUP:
 109             _action_ |= FLAG_ACTION_UPDATE;
 110             break;
 111
 112         case SIGTERM:
 113         case SIGQUIT:
 114         case SIGINT:
 115             _action_ |= FLAG_ACTION_QUIT;
 116             break;
 117
 118         case SIGUSR1:
 119             _action_ |= FLAG_ACTION_RELOAD;
 120             _action_ |= FLAG_ACTION_UPDATE;
 121             break;
 122
 123         default:
 124             plog("fsig(): unknown signal %d -- investigate", signal);
 125             break;
 126     }
 127 }
 128
 129 static void
 130 usage(char *name)
 131 {
 132     fprintf(stderr, "Usage: starter [--nofork] [--auto-update <sec>] "
 133             "[--debug|--debug-more|--debug-all]\n");
 134     exit(1);
 135 }
 136
 137 int main (int argc, char **argv)
 138 {
 139     starter_config_t *cfg = NULL;
 140     starter_config_t *new_cfg;
 141     starter_conn_t *conn, *conn2;
 142     starter_ca_t *ca, *ca2;
 143
 144     struct stat stb;
 145
 146     char *err = NULL;
 147     int i;
 148     int id = 1;
 149     struct timeval tv;
 150     unsigned long auto_update = 0;
 151     time_t last_reload;
 152     bool no_fork = FALSE;
 153
 154     /* global variables defined in log.h */
 155     log_to_stderr = TRUE;
 156     base_debugging = DBG_NONE;
 157
 158     /* parse command line */
 159     for (i = 1; i < argc; i++)
 160     {
 161         if (streq(argv[i], "--debug"))
 162         {
 163             base_debugging |= DBG_CONTROL;
 164         }
 165         else if (streq(argv[i], "--debug-more"))
 166         {
 167             base_debugging |= DBG_CONTROLMORE;
 168         }
 169         else if (streq(argv[i], "--debug-all"))
 170         {
 171             base_debugging |= DBG_ALL;
 172         }
 173         else if (streq(argv[i], "--nofork"))
 174         {
 175             no_fork = TRUE;
 176         }
 177         else if (streq(argv[i], "--auto-update") && i+1 < argc)
 178         {
 179             auto_update = atoi(argv[++i]);
 180             if (!auto_update)
 181                 usage(argv[0]);
 182         }
 183         else
 184         {
 185             usage(argv[0]);
 186         }
 187     }
 188
 189     /* Init */
 190     init_log("ipsec_starter");
 191     cur_debugging = base_debugging;
 192
 193     signal(SIGHUP,  fsig);
 194     signal(SIGCHLD, fsig);
 195     signal(SIGPIPE, fsig);
 196     signal(SIGINT,  fsig);
 197     signal(SIGTERM, fsig);
 198     signal(SIGQUIT, fsig);
 199     signal(SIGALRM, fsig);
 200     signal(SIGUSR1, fsig);
 201
 202     plog("Starting strongSwan %s IPsec [starter]...", ipsec_version_code());
 203
 204     /* verify that we can start */
 205     if (getuid() != 0)
 206     {
 207         plog("permission denied (must be superuser)");
 208         exit(1);
 209     }
 210
 211     if (stat(PLUTO_PID_FILE, &stb) == 0)
 212     {
 213         plog("pluto is already running (%s exists) -- skipping pluto start", PLUTO_PID_FILE);
 214     }
 215     else
 216     {
 217         _action_ |= FLAG_ACTION_START_PLUTO;
 218     }
 219     if (stat(CHARON_PID_FILE, &stb) == 0)
 220     {
 221         plog("charon is already running (%s exists) -- skipping charon start", CHARON_PID_FILE);
 222     }
 223     else
 224     {
 225         _action_ |= FLAG_ACTION_START_CHARON;
 226     }
 227     if (stat(DEV_RANDOM, &stb) != 0)
 228     {
 229         plog("unable to start strongSwan IPsec -- no %s!", DEV_RANDOM);
 230         exit(1);
 231     }
 232
 233     if (stat(DEV_URANDOM, &stb)!= 0)
 234     {
 235         plog("unable to start strongSwan IPsec -- no %s!", DEV_URANDOM);
 236         exit(1);
 237     }
 238
 239     cfg = confread_load(CONFIG_FILE);
 240     if (!cfg)
 241     {
 242         plog("unable to start strongSwan -- errors in config");
 243         exit(1);
 244     }
 245
 246     /* determine if we have a native netkey IPsec stack */
 247     if (!starter_netkey_init())
 248     {
 249         plog("no netkey IPSec stack detected");
 250         exit(1);
 251     }
 252
 253     last_reload = time(NULL);
 254
 255     if (stat(STARTER_PID_FILE, &stb) == 0)
 256     {
 257         plog("starter is already running (%s exists) -- no fork done", STARTER_PID_FILE);
 258         exit(0);
 259     }
 260
 261     /* fork if we're not debugging stuff */
 262     if (!no_fork)
 263     {
 264         log_to_stderr = FALSE;
 265
 266         switch (fork())
 267         {
 268             case 0:
 269             {
 270                 int fnull = open("/dev/null", O_RDWR);
 271
 272                 if (fnull >= 0)
 273                 {
 274                     dup2(fnull, STDIN_FILENO);
 275                     dup2(fnull, STDOUT_FILENO);
 276                     dup2(fnull, STDERR_FILENO);
 277                     close(fnull);
 278                 }
 279             }
 280             break;
 281             case -1:
 282                 plog("can't fork: %s", strerror(errno));
 283                 break;
 284             default:
 285                 exit(0);
 286         }
 287     }
 288
 289     /* save pid file in /var/run/starter.pid */
 290     {
 291         FILE *fd = fopen(STARTER_PID_FILE, "w");
 292
 293         if (fd)
 294         {
 295             fprintf(fd, "%u\n", getpid());
 296             fclose(fd);
 297         }
 298     }
 299
 300     for (;;)
 301     {
 302         /*
 303          * Stop pluto/charon (if started) and exit
 304          */
 305         if (_action_ & FLAG_ACTION_QUIT)
 306         {
 307             if (starter_pluto_pid())
 308                 starter_stop_pluto();
 309             if (starter_charon_pid())
 310                 starter_stop_charon();
 311             starter_netkey_cleanup();
 312             confread_free(cfg);
 313             unlink(STARTER_PID_FILE);
 314             unlink(INFO_FILE);
 315 #ifdef LEAK_DETECTIVE
 316             report_leaks();
 317 #endif /* LEAK_DETECTIVE */
 318             close_log();
 319             plog("ipsec starter stopped");
 320             exit(0);
 321         }
 322
 323         /*
 324          * Delete all connections. Will be added below
 325          */
 326         if (_action_ & FLAG_ACTION_RELOAD)
 327         {
 328             if (starter_pluto_pid() || starter_charon_pid())
 329             {
 330                 for (conn = cfg->conn_first; conn; conn = conn->next)
 331                 {
 332                     if (conn->state == STATE_ADDED)
 333                     {
 334                         if (starter_charon_pid())
 335                         {
 336                             starter_stroke_del_conn(conn);
 337                         }
 338                         if (starter_pluto_pid())
 339                         {
 340                             starter_whack_del_conn(conn);
 341                         }
 342                         conn->state = STATE_TO_ADD;
 343                     }
 344                 }
 345                 for (ca = cfg->ca_first; ca; ca = ca->next)
 346                 {
 347                     if (ca->state == STATE_ADDED)
 348                     {
 349                         if (starter_charon_pid())
 350                         {
 351                             starter_stroke_del_ca(ca);
 352                         }
 353                         if (starter_pluto_pid())
 354                         {
 355                             starter_whack_del_ca(ca);
 356                         }
 357                         ca->state = STATE_TO_ADD;
 358                     }
 359                 }
 360             }
 361             _action_ &= ~FLAG_ACTION_RELOAD;
 362         }
 363
 364         /*
 365          * Update configuration
 366          */
 367         if (_action_ & FLAG_ACTION_UPDATE)
 368         {
 369             err = NULL;
 370             DBG(DBG_CONTROL,
 371                 DBG_log("Reloading config...")
 372                );
 373             new_cfg = confread_load(CONFIG_FILE);
 374
 375             if (new_cfg)
 376             {
 377                 /* Switch to new config. New conn will be loaded below */
 378                 if (!starter_cmp_defaultroute(&new_cfg->defaultroute
 379                                    , &cfg->defaultroute))
 380                 {
 381                     _action_ |= FLAG_ACTION_LISTEN;
 382                 }
 383
 384                 if (!starter_cmp_pluto(cfg, new_cfg))
 385                 {
 386                     plog("Pluto has changed");
 387                     if (starter_pluto_pid())
 388                         starter_stop_pluto();
 389                     _action_ &= ~FLAG_ACTION_LISTEN;
 390                     _action_ |= FLAG_ACTION_START_PLUTO;
 391                 }
 392                 else
 393                 {
 394                     /* Only reload conn and ca sections if pluto is not killed */
 395
 396                     /* Look for new connections that are already loaded */
 397                     for (conn = cfg->conn_first; conn; conn = conn->next)
 398                     {
 399                         if (conn->state == STATE_ADDED)
 400                         {
 401                             for (conn2 = new_cfg->conn_first; conn2; conn2 = conn2->next)
 402                             {
 403                                 if (conn2->state == STATE_TO_ADD && starter_cmp_conn(conn, conn2))
 404                                 {
 405                                     conn->state = STATE_REPLACED;
 406                                     conn2->state = STATE_ADDED;
 407                                     conn2->id = conn->id;
 408                                     break;
 409                                 }
 410                             }
 411                         }
 412                     }
 413
 414                     /* Remove conn sections that have become unused */
 415                     for (conn = cfg->conn_first; conn; conn = conn->next)
 416                     {
 417                         if (conn->state == STATE_ADDED)
 418                         {
 419                             if (starter_charon_pid())
 420                             {
 421                                 starter_stroke_del_conn(conn);
 422                             }
 423                             if (starter_pluto_pid())
 424                             {
 425                                 starter_whack_del_conn(conn);
 426                             }
 427                         }
 428                     }
 429
 430                     /* Look for new ca sections that are already loaded */
 431                     for (ca = cfg->ca_first; ca; ca = ca->next)
 432                     {
 433                         if (ca->state == STATE_ADDED)
 434                         {
 435                             for (ca2 = new_cfg->ca_first; ca2; ca2 = ca2->next)
 436                             {
 437                                 if (ca2->state == STATE_TO_ADD && starter_cmp_ca(ca, ca2))
 438                                 {
 439                                     ca->state = STATE_REPLACED;
 440                                     ca2->state = STATE_ADDED;
 441                                     break;
 442                                 }
 443                             }
 444                         }
 445                     }
 446
 447                     /* Remove ca sections that have become unused */
 448                     for (ca = cfg->ca_first; ca; ca = ca->next)
 449                     {
 450                         if (ca->state == STATE_ADDED)
 451                         {
 452                             if (starter_charon_pid())
 453                             {
 454                                 starter_stroke_del_ca(ca);
 455                             }
 456                             if (starter_pluto_pid())
 457                             {
 458                                 starter_whack_del_ca(ca);
 459                             }
 460                         }
 461                     }
 462                 }
 463                 confread_free(cfg);
 464                 cfg = new_cfg;
 465             }
 466             else
 467             {
 468                 plog("can't reload config file: %s -- keeping old one");
 469             }
 470             _action_ &= ~FLAG_ACTION_UPDATE;
 471             last_reload = time(NULL);
 472         }
 473
 474         /*
 475          * Start pluto
 476          */
 477         if (_action_ & FLAG_ACTION_START_PLUTO)
 478         {
 479             if (cfg->setup.plutostart && !starter_pluto_pid())
 480             {
 481                 DBG(DBG_CONTROL,
 482                     DBG_log("Attempting to start pluto...")
 483                    );
 484
 485                 if (starter_start_pluto(cfg, no_fork) == 0)
 486                 {
 487                     starter_whack_listen();
 488                 }
 489                 else
 490                 {
 491                     /* schedule next try */
 492                     alarm(PLUTO_RESTART_DELAY);
 493                 }
 494             }
 495             _action_ &= ~FLAG_ACTION_START_PLUTO;
 496
 497             for (ca = cfg->ca_first; ca; ca = ca->next)
 498             {
 499                 if (ca->state == STATE_ADDED)
 500                     ca->state = STATE_TO_ADD;
 501             }
 502
 503             for (conn = cfg->conn_first; conn; conn = conn->next)
 504             {
 505                 if (conn->state == STATE_ADDED)
 506                     conn->state = STATE_TO_ADD;
 507             }
 508         }
 509
 510         /*
 511          * Start charon
 512          */
 513         if (_action_ & FLAG_ACTION_START_CHARON)
 514         {
 515             if (cfg->setup.charonstart && !starter_charon_pid())
 516             {
 517                 DBG(DBG_CONTROL,
 518                     DBG_log("Attempting to start charon...")
 519                    );
 520                 if (starter_start_charon(cfg, no_fork))
 521                 {
 522                     /* schedule next try */
 523                     alarm(PLUTO_RESTART_DELAY);
 524                 }
 525             }
 526             _action_ &= ~FLAG_ACTION_START_CHARON;
 527         }
 528
 529         /*
 530          * Tell pluto to reread its interfaces
 531          */
 532         if (_action_ & FLAG_ACTION_LISTEN)
 533         {
 534             if (starter_pluto_pid())
 535             {
 536                 starter_whack_listen();
 537                 _action_ &= ~FLAG_ACTION_LISTEN;
 538             }
 539         }
 540
 541         /*
 542          * Add stale conn and ca sections
 543          */
 544         if (starter_pluto_pid() || starter_charon_pid())
 545         {
 546             for (ca = cfg->ca_first; ca; ca = ca->next)
 547             {
 548                 if (ca->state == STATE_TO_ADD)
 549                 {
 550                     if (starter_charon_pid())
 551                     {
 552                         starter_stroke_add_ca(ca);
 553                     }
 554                     if (starter_pluto_pid())
 555                     {
 556                         starter_whack_add_ca(ca);
 557                     }
 558                     ca->state = STATE_ADDED;
 559                 }
 560             }
 561
 562             for (conn = cfg->conn_first; conn; conn = conn->next)
 563             {
 564                 if (conn->state == STATE_TO_ADD)
 565                 {
 566                     if (conn->id == 0)
 567                     {
 568                         /* affect new unique id */
 569                         conn->id = id++;
 570                     }
 571                     if (starter_charon_pid())
 572                     {
 573                         starter_stroke_add_conn(conn);
 574                     }
 575                     if (starter_pluto_pid())
 576                     {
 577                         starter_whack_add_conn(conn);
 578                     }
 579                     conn->state = STATE_ADDED;
 580
 581                     if (conn->startup == STARTUP_START)
 582                     {
 583                         if (conn->keyexchange == KEY_EXCHANGE_IKEV2)
 584                         {
 585                             if (starter_charon_pid())
 586                             {
 587                                 starter_stroke_initiate_conn(conn);
 588                             }
 589                         }
 590                         else
 591                         {
 592                             if (starter_pluto_pid())
 593                             {
 594                                 starter_whack_initiate_conn(conn);
 595                             }
 596                         }
 597                     }
 598                     else if (conn->startup == STARTUP_ROUTE)
 599                     {
 600                         if (conn->keyexchange == KEY_EXCHANGE_IKEV2)
 601                         {
 602                             if (starter_charon_pid())
 603                             {
 604                                 starter_stroke_route_conn(conn);
 605                             }
 606                         }
 607                         else
 608                         {
 609                             if (starter_pluto_pid())
 610                             {
 611                                 starter_whack_route_conn(conn);
 612                             }
 613                         }
 614                     }
 615                 }
 616             }
 617         }
 618
 619         /*
 620          * If auto_update activated, when to stop select
 621          */
 622         if (auto_update)
 623         {
 624             time_t now = time(NULL);
 625
 626             tv.tv_sec = (now < last_reload + auto_update)
 627                     ? (last_reload + auto_update-now) : 0;
 628             tv.tv_usec = 0;
 629         }
 630
 631         /*
 632          * Wait for something to happen
 633          */
 634         if (select(0, NULL, NULL, NULL, auto_update ? &tv : NULL) == 0)
 635         {
 636             /* timeout -> auto_update */
 637             _action_ |= FLAG_ACTION_UPDATE;
 638         }
 639     }
 640
 641     return 0;
 642 }
 643