Moved ha plugin to libcharon
authorMartin Willi <martin@revosec.ch>
Fri, 19 Mar 2010 18:03:46 +0000 (19:03 +0100)
committerMartin Willi <martin@revosec.ch>
Wed, 7 Apr 2010 11:55:16 +0000 (13:55 +0200)
43 files changed:
src/charon/plugins/ha/Makefile.am [deleted file]
src/charon/plugins/ha/ha_child.c [deleted file]
src/charon/plugins/ha/ha_child.h [deleted file]
src/charon/plugins/ha/ha_ctl.c [deleted file]
src/charon/plugins/ha/ha_ctl.h [deleted file]
src/charon/plugins/ha/ha_dispatcher.c [deleted file]
src/charon/plugins/ha/ha_dispatcher.h [deleted file]
src/charon/plugins/ha/ha_ike.c [deleted file]
src/charon/plugins/ha/ha_ike.h [deleted file]
src/charon/plugins/ha/ha_kernel.c [deleted file]
src/charon/plugins/ha/ha_kernel.h [deleted file]
src/charon/plugins/ha/ha_message.c [deleted file]
src/charon/plugins/ha/ha_message.h [deleted file]
src/charon/plugins/ha/ha_plugin.c [deleted file]
src/charon/plugins/ha/ha_plugin.h [deleted file]
src/charon/plugins/ha/ha_segments.c [deleted file]
src/charon/plugins/ha/ha_segments.h [deleted file]
src/charon/plugins/ha/ha_socket.c [deleted file]
src/charon/plugins/ha/ha_socket.h [deleted file]
src/charon/plugins/ha/ha_tunnel.c [deleted file]
src/charon/plugins/ha/ha_tunnel.h [deleted file]
src/libcharon/Makefile.am
src/libcharon/plugins/ha/Makefile.am [new file with mode: 0644]
src/libcharon/plugins/ha/ha_child.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_child.h [new file with mode: 0644]
src/libcharon/plugins/ha/ha_ctl.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_ctl.h [new file with mode: 0644]
src/libcharon/plugins/ha/ha_dispatcher.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_dispatcher.h [new file with mode: 0644]
src/libcharon/plugins/ha/ha_ike.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_ike.h [new file with mode: 0644]
src/libcharon/plugins/ha/ha_kernel.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_kernel.h [new file with mode: 0644]
src/libcharon/plugins/ha/ha_message.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_message.h [new file with mode: 0644]
src/libcharon/plugins/ha/ha_plugin.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_plugin.h [new file with mode: 0644]
src/libcharon/plugins/ha/ha_segments.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_segments.h [new file with mode: 0644]
src/libcharon/plugins/ha/ha_socket.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_socket.h [new file with mode: 0644]
src/libcharon/plugins/ha/ha_tunnel.c [new file with mode: 0644]
src/libcharon/plugins/ha/ha_tunnel.h [new file with mode: 0644]

diff --git a/src/charon/plugins/ha/Makefile.am b/src/charon/plugins/ha/Makefile.am
deleted file mode 100644 (file)
index 52dc95d..0000000
+++ /dev/null
@@ -1,19 +0,0 @@
-
-INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
-
-AM_CFLAGS = -rdynamic -DIPSEC_PIDDIR=\"${piddir}\"
-
-plugin_LTLIBRARIES = libstrongswan-ha.la
-libstrongswan_ha_la_SOURCES = \
-  ha_plugin.h ha_plugin.c \
-  ha_message.h ha_message.c \
-  ha_socket.h ha_socket.c \
-  ha_tunnel.h ha_tunnel.c \
-  ha_dispatcher.h ha_dispatcher.c \
-  ha_segments.h ha_segments.c \
-  ha_kernel.h ha_kernel.c \
-  ha_ctl.h ha_ctl.c \
-  ha_ike.h ha_ike.c \
-  ha_child.h ha_child.c
-libstrongswan_ha_la_LDFLAGS = -module
-
diff --git a/src/charon/plugins/ha/ha_child.c b/src/charon/plugins/ha/ha_child.c
deleted file mode 100644 (file)
index 2eb8e27..0000000
+++ /dev/null
@@ -1,170 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ha_child.h"
-
-typedef struct private_ha_child_t private_ha_child_t;
-
-/**
- * Private data of an ha_child_t object.
- */
-struct private_ha_child_t {
-
-       /**
-        * Public ha_child_t interface.
-        */
-       ha_child_t public;
-
-       /**
-        * socket we use for syncing
-        */
-       ha_socket_t *socket;
-
-       /**
-        * tunnel securing sync messages
-        */
-       ha_tunnel_t *tunnel;
-};
-
-/**
- * Implementation of listener_t.child_keys
- */
-static bool child_keys(private_ha_child_t *this, ike_sa_t *ike_sa,
-                                          child_sa_t *child_sa, diffie_hellman_t *dh,
-                                          chunk_t nonce_i, chunk_t nonce_r)
-{
-       ha_message_t *m;
-       chunk_t secret;
-       proposal_t *proposal;
-       u_int16_t alg, len;
-       linked_list_t *list;
-       enumerator_t *enumerator;
-       traffic_selector_t *ts;
-
-       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
-       {       /* do not sync SA between nodes */
-               return TRUE;
-       }
-
-       m = ha_message_create(HA_CHILD_ADD);
-
-       m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
-       m->add_attribute(m, HA_INBOUND_SPI, child_sa->get_spi(child_sa, TRUE));
-       m->add_attribute(m, HA_OUTBOUND_SPI, child_sa->get_spi(child_sa, FALSE));
-       m->add_attribute(m, HA_INBOUND_CPI, child_sa->get_cpi(child_sa, TRUE));
-       m->add_attribute(m, HA_OUTBOUND_CPI, child_sa->get_cpi(child_sa, FALSE));
-       m->add_attribute(m, HA_IPSEC_MODE, child_sa->get_mode(child_sa));
-       m->add_attribute(m, HA_IPCOMP, child_sa->get_ipcomp(child_sa));
-       m->add_attribute(m, HA_CONFIG_NAME, child_sa->get_name(child_sa));
-
-       proposal = child_sa->get_proposal(child_sa);
-       if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &len))
-       {
-               m->add_attribute(m, HA_ALG_ENCR, alg);
-               if (len)
-               {
-                       m->add_attribute(m, HA_ALG_ENCR_LEN, len);
-               }
-       }
-       if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
-       {
-               m->add_attribute(m, HA_ALG_INTEG, alg);
-       }
-       m->add_attribute(m, HA_NONCE_I, nonce_i);
-       m->add_attribute(m, HA_NONCE_R, nonce_r);
-       if (dh && dh->get_shared_secret(dh, &secret) == SUCCESS)
-       {
-               m->add_attribute(m, HA_SECRET, secret);
-               chunk_clear(&secret);
-       }
-
-       list = child_sa->get_traffic_selectors(child_sa, TRUE);
-       enumerator = list->create_enumerator(list);
-       while (enumerator->enumerate(enumerator, &ts))
-       {
-               m->add_attribute(m, HA_LOCAL_TS, ts);
-       }
-       enumerator->destroy(enumerator);
-       list = child_sa->get_traffic_selectors(child_sa, FALSE);
-       enumerator = list->create_enumerator(list);
-       while (enumerator->enumerate(enumerator, &ts))
-       {
-               m->add_attribute(m, HA_REMOTE_TS, ts);
-       }
-       enumerator->destroy(enumerator);
-
-       this->socket->push(this->socket, m);
-
-       return TRUE;
-}
-
-/**
- * Implementation of listener_t.child_state_change
- */
-static bool child_state_change(private_ha_child_t *this, ike_sa_t *ike_sa,
-                                                          child_sa_t *child_sa, child_sa_state_t state)
-{
-       if (!ike_sa ||
-               ike_sa->get_state(ike_sa) == IKE_PASSIVE ||
-               ike_sa->get_state(ike_sa) == IKE_DESTROYING)
-       {       /* only sync active IKE_SAs */
-               return TRUE;
-       }
-       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
-       {       /* do not sync SA between nodes */
-               return TRUE;
-       }
-
-
-       if (state == CHILD_DESTROYING)
-       {
-               ha_message_t *m;
-
-               m = ha_message_create(HA_CHILD_DELETE);
-
-               m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
-               m->add_attribute(m, HA_INBOUND_SPI,
-                                                child_sa->get_spi(child_sa, TRUE));
-               this->socket->push(this->socket, m);
-       }
-       return TRUE;
-}
-
-/**
- * Implementation of ha_child_t.destroy.
- */
-static void destroy(private_ha_child_t *this)
-{
-       free(this);
-}
-
-/**
- * See header
- */
-ha_child_t *ha_child_create(ha_socket_t *socket, ha_tunnel_t *tunnel)
-{
-       private_ha_child_t *this = malloc_thing(private_ha_child_t);
-
-       memset(&this->public.listener, 0, sizeof(listener_t));
-       this->public.listener.child_keys = (bool(*)(listener_t*, ike_sa_t *ike_sa, child_sa_t *child_sa, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r))child_keys;
-       this->public.listener.child_state_change = (bool(*)(listener_t*,ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state))child_state_change;
-       this->public.destroy = (void(*)(ha_child_t*))destroy;
-
-       this->socket = socket;
-       this->tunnel = tunnel;
-
-       return &this->public;
-}
-
diff --git a/src/charon/plugins/ha/ha_child.h b/src/charon/plugins/ha/ha_child.h
deleted file mode 100644 (file)
index ea83495..0000000
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha_child ha_child
- * @{ @ingroup ha
- */
-
-#ifndef HA_CHILD_H_
-#define HA_CHILD_H_
-
-#include "ha_socket.h"
-#include "ha_tunnel.h"
-#include "ha_segments.h"
-
-#include <daemon.h>
-
-typedef struct ha_child_t ha_child_t;
-
-/**
- * Listener to synchronize CHILD_SAs.
- */
-struct ha_child_t {
-
-       /**
-        * Implements bus listener interface.
-        */
-       listener_t listener;
-
-       /**
-        * Destroy a ha_child_t.
-        */
-       void (*destroy)(ha_child_t *this);
-};
-
-/**
- * Create a ha_child instance.
- *
- * @param socket               socket to use for sending synchronization messages
- * @param tunnel               tunnel securing sync messages, if any
- * @return                             CHILD listener
- */
-ha_child_t *ha_child_create(ha_socket_t *socket, ha_tunnel_t *tunnel);
-
-#endif /* HA_CHILD_ @}*/
diff --git a/src/charon/plugins/ha/ha_ctl.c b/src/charon/plugins/ha/ha_ctl.c
deleted file mode 100644 (file)
index 441d26d..0000000
+++ /dev/null
@@ -1,132 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ha_ctl.h"
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/select.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <errno.h>
-#include <pthread.h>
-
-#include <processing/jobs/callback_job.h>
-
-#define HA_FIFO IPSEC_PIDDIR "/charon.ha"
-
-typedef struct private_ha_ctl_t private_ha_ctl_t;
-
-/**
- * Private data of an ha_ctl_t object.
- */
-struct private_ha_ctl_t {
-
-       /**
-        * Public ha_ctl_t interface.
-        */
-       ha_ctl_t public;
-
-       /**
-        * Segments to control
-        */
-       ha_segments_t *segments;
-
-       /**
-        * FIFO reader thread
-        */
-       callback_job_t *job;
-};
-
-/**
- * FIFO dispatching function
- */
-static job_requeue_t dispatch_fifo(private_ha_ctl_t *this)
-{
-       int fifo, old;
-       char buf[8];
-       u_int segment;
-
-       pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &old);
-       fifo = open(HA_FIFO, O_RDONLY);
-       pthread_setcancelstate(old, NULL);
-       if (fifo == -1)
-       {
-               DBG1(DBG_CFG, "opening HA fifo failed: %s", strerror(errno));
-               sleep(1);
-               return JOB_REQUEUE_FAIR;
-       }
-
-       memset(buf, 0, sizeof(buf));
-       if (read(fifo, buf, sizeof(buf)-1) > 1)
-       {
-               segment = atoi(&buf[1]);
-               if (segment)
-               {
-                       switch (buf[0])
-                       {
-                               case '+':
-                                       this->segments->activate(this->segments, segment, TRUE);
-                                       break;
-                               case '-':
-                                       this->segments->deactivate(this->segments, segment, TRUE);
-                                       break;
-                               case '*':
-                                       this->segments->resync(this->segments, segment);
-                                       break;
-                               default:
-                                       break;
-                       }
-               }
-       }
-       close(fifo);
-
-       return JOB_REQUEUE_DIRECT;
-}
-
-/**
- * Implementation of ha_ctl_t.destroy.
- */
-static void destroy(private_ha_ctl_t *this)
-{
-       this->job->cancel(this->job);
-       free(this);
-}
-
-/**
- * See header
- */
-ha_ctl_t *ha_ctl_create(ha_segments_t *segments)
-{
-       private_ha_ctl_t *this = malloc_thing(private_ha_ctl_t);
-
-       this->public.destroy = (void(*)(ha_ctl_t*))destroy;
-
-       if (access(HA_FIFO, R_OK|W_OK) != 0)
-       {
-               if (mkfifo(HA_FIFO, 600) != 0)
-               {
-                       DBG1(DBG_CFG, "creating HA FIFO %s failed: %s",
-                                HA_FIFO, strerror(errno));
-               }
-       }
-
-       this->segments = segments;
-       this->job = callback_job_create((callback_job_cb_t)dispatch_fifo,
-                                                                       this, NULL, NULL);
-       charon->processor->queue_job(charon->processor, (job_t*)this->job);
-       return &this->public;
-}
-
diff --git a/src/charon/plugins/ha/ha_ctl.h b/src/charon/plugins/ha/ha_ctl.h
deleted file mode 100644 (file)
index f33a809..0000000
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha_ctl ha_ctl
- * @{ @ingroup ha
- */
-
-#ifndef HA_CTL_H_
-#define HA_CTL_H_
-
-#include "ha_segments.h"
-
-typedef struct ha_ctl_t ha_ctl_t;
-
-/**
- * HA Sync control interface using a FIFO.
- */
-struct ha_ctl_t {
-
-       /**
-        * Destroy a ha_ctl_t.
-        */
-       void (*destroy)(ha_ctl_t *this);
-};
-
-/**
- * Create a ha_ctl instance.
- *
- * @param segments     segments to control
- * @return                     HA control interface
- */
-ha_ctl_t *ha_ctl_create(ha_segments_t *segments);
-
-#endif /* HA_CTL_ @}*/
diff --git a/src/charon/plugins/ha/ha_dispatcher.c b/src/charon/plugins/ha/ha_dispatcher.c
deleted file mode 100644 (file)
index 4acf747..0000000
+++ /dev/null
@@ -1,737 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ha_dispatcher.h"
-
-#include <daemon.h>
-#include <processing/jobs/callback_job.h>
-
-typedef struct private_ha_dispatcher_t private_ha_dispatcher_t;
-
-/**
- * Private data of an ha_dispatcher_t object.
- */
-struct private_ha_dispatcher_t {
-
-       /**
-        * Public ha_dispatcher_t interface.
-        */
-       ha_dispatcher_t public;
-
-       /**
-        * socket to pull messages from
-        */
-       ha_socket_t *socket;
-
-       /**
-        * segments to control
-        */
-       ha_segments_t *segments;
-
-       /**
-        * Dispatcher job
-        */
-       callback_job_t *job;
-};
-
-/**
- * Quick and dirty hack implementation of diffie_hellman_t.get_shared_secret
- */
-static status_t get_shared_secret(diffie_hellman_t *this, chunk_t *secret)
-{
-       *secret = chunk_clone((*(chunk_t*)this->destroy));
-       return SUCCESS;
-}
-
-/**
- * Process messages of type IKE_ADD
- */
-static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message)
-{
-       ha_message_attribute_t attribute;
-       ha_message_value_t value;
-       enumerator_t *enumerator;
-       ike_sa_t *ike_sa = NULL, *old_sa = NULL;
-       u_int16_t encr = 0, len = 0, integ = 0, prf = 0, old_prf = PRF_UNDEFINED;
-       chunk_t nonce_i = chunk_empty, nonce_r = chunk_empty;
-       chunk_t secret = chunk_empty, old_skd = chunk_empty;
-
-       enumerator = message->create_attribute_enumerator(message);
-       while (enumerator->enumerate(enumerator, &attribute, &value))
-       {
-               switch (attribute)
-               {
-                       case HA_IKE_ID:
-                               ike_sa = ike_sa_create(value.ike_sa_id);
-                               break;
-                       case HA_IKE_REKEY_ID:
-                               old_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
-                                                                                                                 value.ike_sa_id);
-                               break;
-                       case HA_NONCE_I:
-                               nonce_i = value.chunk;
-                               break;
-                       case HA_NONCE_R:
-                               nonce_r = value.chunk;
-                               break;
-                       case HA_SECRET:
-                               secret = value.chunk;
-                               break;
-                       case HA_OLD_SKD:
-                               old_skd = value.chunk;
-                               break;
-                       case HA_ALG_ENCR:
-                               encr = value.u16;
-                               break;
-                       case HA_ALG_ENCR_LEN:
-                               len = value.u16;
-                               break;
-                       case HA_ALG_INTEG:
-                               integ = value.u16;
-                               break;
-                       case HA_ALG_PRF:
-                               prf = value.u16;
-                               break;
-                       case HA_ALG_OLD_PRF:
-                               old_prf = value.u16;
-                               break;
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-
-       if (ike_sa)
-       {
-               proposal_t *proposal;
-               keymat_t *keymat;
-               /* quick and dirty hack of a DH implementation ;-) */
-               diffie_hellman_t dh = { .get_shared_secret = get_shared_secret,
-                                                               .destroy = (void*)&secret };
-
-               proposal = proposal_create(PROTO_IKE);
-               keymat = ike_sa->get_keymat(ike_sa);
-               if (integ)
-               {
-                       proposal->add_algorithm(proposal, INTEGRITY_ALGORITHM, integ, 0);
-               }
-               if (encr)
-               {
-                       proposal->add_algorithm(proposal, ENCRYPTION_ALGORITHM, encr, len);
-               }
-               if (prf)
-               {
-                       proposal->add_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, prf, 0);
-               }
-               charon->bus->set_sa(charon->bus, ike_sa);
-               if (keymat->derive_ike_keys(keymat, proposal, &dh, nonce_i, nonce_r,
-                                                                        ike_sa->get_id(ike_sa), old_prf, old_skd))
-               {
-                       if (old_sa)
-                       {
-                               peer_cfg_t *peer_cfg = old_sa->get_peer_cfg(old_sa);
-
-                               if (peer_cfg)
-                               {
-                                       ike_sa->set_peer_cfg(ike_sa, peer_cfg);
-                                       ike_sa->inherit(ike_sa, old_sa);
-                               }
-                               charon->ike_sa_manager->checkin_and_destroy(
-                                                                                               charon->ike_sa_manager, old_sa);
-                               old_sa = NULL;
-                       }
-                       ike_sa->set_state(ike_sa, IKE_CONNECTING);
-                       charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
-               }
-               else
-               {
-                       DBG1(DBG_IKE, "HA keymat derivation failed");
-                       ike_sa->destroy(ike_sa);
-               }
-               charon->bus->set_sa(charon->bus, NULL);
-               proposal->destroy(proposal);
-       }
-       if (old_sa)
-       {
-               charon->ike_sa_manager->checkin(charon->ike_sa_manager, old_sa);
-       }
-}
-
-/**
- * Apply a condition flag to the IKE_SA if it is in set
- */
-static void set_condition(ike_sa_t *ike_sa, ike_condition_t set,
-                                                 ike_condition_t flag)
-{
-       ike_sa->set_condition(ike_sa, flag, flag & set);
-}
-
-/**
- * Apply a extension flag to the IKE_SA if it is in set
- */
-static void set_extension(ike_sa_t *ike_sa, ike_extension_t set,
-                                                 ike_extension_t flag)
-{
-       if (flag & set)
-       {
-               ike_sa->enable_extension(ike_sa, flag);
-       }
-}
-
-/**
- * Process messages of type IKE_UPDATE
- */
-static void process_ike_update(private_ha_dispatcher_t *this,
-                                                          ha_message_t *message)
-{
-       ha_message_attribute_t attribute;
-       ha_message_value_t value;
-       enumerator_t *enumerator;
-       ike_sa_t *ike_sa = NULL;
-       peer_cfg_t *peer_cfg = NULL;
-
-       enumerator = message->create_attribute_enumerator(message);
-       while (enumerator->enumerate(enumerator, &attribute, &value))
-       {
-               if (attribute != HA_IKE_ID && ike_sa == NULL)
-               {
-                       /* must be first attribute */
-                       break;
-               }
-               switch (attribute)
-               {
-                       case HA_IKE_ID:
-                               ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
-                                                                                                                 value.ike_sa_id);
-                               break;
-                       case HA_LOCAL_ID:
-                               ike_sa->set_my_id(ike_sa, value.id->clone(value.id));
-                               break;
-                       case HA_REMOTE_ID:
-                               ike_sa->set_other_id(ike_sa, value.id->clone(value.id));
-                               break;
-                       case HA_EAP_ID:
-                               ike_sa->set_eap_identity(ike_sa, value.id->clone(value.id));
-                               break;
-                       case HA_LOCAL_ADDR:
-                               ike_sa->set_my_host(ike_sa, value.host->clone(value.host));
-                               break;
-                       case HA_REMOTE_ADDR:
-                               ike_sa->set_other_host(ike_sa, value.host->clone(value.host));
-                               break;
-                       case HA_LOCAL_VIP:
-                               ike_sa->set_virtual_ip(ike_sa, TRUE, value.host);
-                               break;
-                       case HA_REMOTE_VIP:
-                               ike_sa->set_virtual_ip(ike_sa, FALSE, value.host);
-                               break;
-                       case HA_ADDITIONAL_ADDR:
-                               ike_sa->add_additional_address(ike_sa,
-                                                                                          value.host->clone(value.host));
-                               break;
-                       case HA_CONFIG_NAME:
-                               peer_cfg = charon->backends->get_peer_cfg_by_name(
-                                                                                               charon->backends, value.str);
-                               if (peer_cfg)
-                               {
-                                       ike_sa->set_peer_cfg(ike_sa, peer_cfg);
-                                       peer_cfg->destroy(peer_cfg);
-                               }
-                               else
-                               {
-                                       DBG1(DBG_IKE, "HA is missing nodes peer configuration");
-                               }
-                               break;
-                       case HA_EXTENSIONS:
-                               set_extension(ike_sa, value.u32, EXT_NATT);
-                               set_extension(ike_sa, value.u32, EXT_MOBIKE);
-                               set_extension(ike_sa, value.u32, EXT_HASH_AND_URL);
-                               break;
-                       case HA_CONDITIONS:
-                               set_condition(ike_sa, value.u32, COND_NAT_ANY);
-                               set_condition(ike_sa, value.u32, COND_NAT_HERE);
-                               set_condition(ike_sa, value.u32, COND_NAT_THERE);
-                               set_condition(ike_sa, value.u32, COND_NAT_FAKE);
-                               set_condition(ike_sa, value.u32, COND_EAP_AUTHENTICATED);
-                               set_condition(ike_sa, value.u32, COND_CERTREQ_SEEN);
-                               set_condition(ike_sa, value.u32, COND_ORIGINAL_INITIATOR);
-                               break;
-                       case HA_INITIATE_MID:
-                               ike_sa->set_message_id(ike_sa, TRUE, value.u32);
-                               break;
-                       case HA_RESPOND_MID:
-                               ike_sa->set_message_id(ike_sa, FALSE, value.u32);
-                               break;
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-
-       if (ike_sa)
-       {
-               if (ike_sa->get_state(ike_sa) == IKE_CONNECTING &&
-                       ike_sa->get_peer_cfg(ike_sa))
-               {
-                       ike_sa->set_state(ike_sa, IKE_PASSIVE);
-               }
-               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
-       }
-}
-
-/**
- * Process messages of type IKE_DELETE
- */
-static void process_ike_delete(private_ha_dispatcher_t *this,
-                                                          ha_message_t *message)
-{
-       ha_message_attribute_t attribute;
-       ha_message_value_t value;
-       enumerator_t *enumerator;
-       ike_sa_t *ike_sa;
-
-       enumerator = message->create_attribute_enumerator(message);
-       while (enumerator->enumerate(enumerator, &attribute, &value))
-       {
-               switch (attribute)
-               {
-                       case HA_IKE_ID:
-                               ike_sa = charon->ike_sa_manager->checkout(
-                                                                       charon->ike_sa_manager, value.ike_sa_id);
-                               if (ike_sa)
-                               {
-                                       charon->ike_sa_manager->checkin_and_destroy(
-                                                                       charon->ike_sa_manager, ike_sa);
-                               }
-                               break;
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Lookup a child cfg from the peer cfg by name
- */
-static child_cfg_t* find_child_cfg(ike_sa_t *ike_sa, char *name)
-{
-       peer_cfg_t *peer_cfg;
-       child_cfg_t *current, *found = NULL;
-       enumerator_t *enumerator;
-
-       peer_cfg = ike_sa->get_peer_cfg(ike_sa);
-       if (peer_cfg)
-       {
-               enumerator = peer_cfg->create_child_cfg_enumerator(peer_cfg);
-               while (enumerator->enumerate(enumerator, &current))
-               {
-                       if (streq(current->get_name(current), name))
-                       {
-                               found = current;
-                               break;
-                       }
-               }
-               enumerator->destroy(enumerator);
-       }
-       return found;
-}
-
-/**
- * Process messages of type CHILD_ADD
- */
-static void process_child_add(private_ha_dispatcher_t *this,
-                                                         ha_message_t *message)
-{
-       ha_message_attribute_t attribute;
-       ha_message_value_t value;
-       enumerator_t *enumerator;
-       ike_sa_t *ike_sa = NULL;
-       char *config_name;
-       child_cfg_t *config = NULL;
-       child_sa_t *child_sa;
-       proposal_t *proposal;
-       keymat_t *keymat;
-       bool initiator, failed = FALSE;
-       u_int32_t inbound_spi = 0, outbound_spi = 0;
-       u_int16_t inbound_cpi = 0, outbound_cpi = 0;
-       u_int8_t mode = MODE_TUNNEL, ipcomp = 0;
-       u_int16_t encr = ENCR_UNDEFINED, integ = AUTH_UNDEFINED, len = 0;
-       chunk_t nonce_i = chunk_empty, nonce_r = chunk_empty, secret = chunk_empty;
-       chunk_t encr_i, integ_i, encr_r, integ_r;
-       linked_list_t *local_ts, *remote_ts;
-       /* quick and dirty hack of a DH implementation */
-       diffie_hellman_t dh = { .get_shared_secret = get_shared_secret,
-                                                       .destroy = (void*)&secret };
-
-       enumerator = message->create_attribute_enumerator(message);
-       while (enumerator->enumerate(enumerator, &attribute, &value))
-       {
-               switch (attribute)
-               {
-                       case HA_IKE_ID:
-                               ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
-                                                                                                                 value.ike_sa_id);
-                               initiator = value.ike_sa_id->is_initiator(value.ike_sa_id);
-                               break;
-                       case HA_CONFIG_NAME:
-                               config_name = value.str;
-                               break;
-                       case HA_INBOUND_SPI:
-                               inbound_spi = value.u32;
-                               break;
-                       case HA_OUTBOUND_SPI:
-                               outbound_spi = value.u32;
-                               break;
-                       case HA_INBOUND_CPI:
-                               inbound_cpi = value.u32;
-                               break;
-                       case HA_OUTBOUND_CPI:
-                               outbound_cpi = value.u32;
-                               break;
-                       case HA_IPSEC_MODE:
-                               mode = value.u8;
-                               break;
-                       case HA_IPCOMP:
-                               ipcomp = value.u8;
-                               break;
-                       case HA_ALG_ENCR:
-                               encr = value.u16;
-                               break;
-                       case HA_ALG_ENCR_LEN:
-                               len = value.u16;
-                               break;
-                       case HA_ALG_INTEG:
-                               integ = value.u16;
-                               break;
-                       case HA_NONCE_I:
-                               nonce_i = value.chunk;
-                               break;
-                       case HA_NONCE_R:
-                               nonce_r = value.chunk;
-                               break;
-                       case HA_SECRET:
-                               secret = value.chunk;
-                               break;
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-
-       if (!ike_sa)
-       {
-               DBG1(DBG_CHD, "IKE_SA for HA CHILD_SA not found");
-               return;
-       }
-       config = find_child_cfg(ike_sa, config_name);
-       if (!config)
-       {
-               DBG1(DBG_CHD, "HA is missing nodes child configuration");
-               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
-               return;
-       }
-
-       child_sa = child_sa_create(ike_sa->get_my_host(ike_sa),
-                                                          ike_sa->get_other_host(ike_sa), config, 0,
-                                                          ike_sa->has_condition(ike_sa, COND_NAT_ANY));
-       child_sa->set_mode(child_sa, mode);
-       child_sa->set_protocol(child_sa, PROTO_ESP);
-       child_sa->set_ipcomp(child_sa, ipcomp);
-
-       proposal = proposal_create(PROTO_ESP);
-       if (integ)
-       {
-               proposal->add_algorithm(proposal, INTEGRITY_ALGORITHM, integ, 0);
-       }
-       if (encr)
-       {
-               proposal->add_algorithm(proposal, ENCRYPTION_ALGORITHM, encr, len);
-       }
-       keymat = ike_sa->get_keymat(ike_sa);
-
-       if (!keymat->derive_child_keys(keymat, proposal, secret.ptr ? &dh : NULL,
-                                       nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
-       {
-               DBG1(DBG_CHD, "HA CHILD_SA key derivation failed");
-               child_sa->destroy(child_sa);
-               proposal->destroy(proposal);
-               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
-               return;
-       }
-       child_sa->set_proposal(child_sa, proposal);
-       child_sa->set_state(child_sa, CHILD_INSTALLING);
-       proposal->destroy(proposal);
-
-       if (initiator)
-       {
-               if (child_sa->install(child_sa, encr_r, integ_r,
-                                                         inbound_spi, inbound_cpi, TRUE) != SUCCESS ||
-                       child_sa->install(child_sa, encr_i, integ_i,
-                                                         outbound_spi, outbound_cpi, FALSE) != SUCCESS)
-               {
-                       failed = TRUE;
-               }
-       }
-       else
-       {
-               if (child_sa->install(child_sa, encr_i, integ_i,
-                                                         inbound_spi, inbound_cpi, TRUE) != SUCCESS ||
-                       child_sa->install(child_sa, encr_r, integ_r,
-                                                         outbound_spi, outbound_cpi, FALSE) != SUCCESS)
-               {
-                       failed = TRUE;
-               }
-       }
-       chunk_clear(&encr_i);
-       chunk_clear(&integ_i);
-       chunk_clear(&encr_r);
-       chunk_clear(&integ_r);
-
-       if (failed)
-       {
-               DBG1(DBG_CHD, "HA CHILD_SA installation failed");
-               child_sa->destroy(child_sa);
-               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
-               return;
-       }
-
-       /* TODO: Change CHILD_SA API to avoid cloning twice */
-       local_ts = linked_list_create();
-       remote_ts = linked_list_create();
-       enumerator = message->create_attribute_enumerator(message);
-       while (enumerator->enumerate(enumerator, &attribute, &value))
-       {
-               switch (attribute)
-               {
-                       case HA_LOCAL_TS:
-                               local_ts->insert_last(local_ts, value.ts->clone(value.ts));
-                               break;
-                       case HA_REMOTE_TS:
-                               remote_ts->insert_last(remote_ts, value.ts->clone(value.ts));
-                               break;
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-       child_sa->add_policies(child_sa, local_ts, remote_ts);
-       local_ts->destroy_offset(local_ts, offsetof(traffic_selector_t, destroy));
-       remote_ts->destroy_offset(remote_ts, offsetof(traffic_selector_t, destroy));
-
-       child_sa->set_state(child_sa, CHILD_INSTALLED);
-       ike_sa->add_child_sa(ike_sa, child_sa);
-       charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
-}
-
-/**
- * Process messages of type CHILD_DELETE
- */
-static void process_child_delete(private_ha_dispatcher_t *this,
-                                                                ha_message_t *message)
-{
-       ha_message_attribute_t attribute;
-       ha_message_value_t value;
-       enumerator_t *enumerator;
-       ike_sa_t *ike_sa = NULL;
-
-       enumerator = message->create_attribute_enumerator(message);
-       while (enumerator->enumerate(enumerator, &attribute, &value))
-       {
-               switch (attribute)
-               {
-                       case HA_IKE_ID:
-                               ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
-                                                                                                                 value.ike_sa_id);
-                               break;
-                       case HA_INBOUND_SPI:
-                               if (ike_sa)
-                               {
-                                       ike_sa->destroy_child_sa(ike_sa, PROTO_ESP, value.u32);
-                               }
-                               break;
-                       default:
-                               break;
-               }
-       }
-       if (ike_sa)
-       {
-               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Process messages of type SEGMENT_TAKE/DROP
- */
-static void process_segment(private_ha_dispatcher_t *this,
-                                                       ha_message_t *message, bool take)
-{
-       ha_message_attribute_t attribute;
-       ha_message_value_t value;
-       enumerator_t *enumerator;
-
-       enumerator = message->create_attribute_enumerator(message);
-       while (enumerator->enumerate(enumerator, &attribute, &value))
-       {
-               switch (attribute)
-               {
-                       case HA_SEGMENT:
-                               if (take)
-                               {
-                                       DBG1(DBG_CFG, "remote node takes segment %d", value.u16);
-                                       this->segments->deactivate(this->segments, value.u16, FALSE);
-                               }
-                               else
-                               {
-                                       DBG1(DBG_CFG, "remote node drops segment %d", value.u16);
-                                       this->segments->activate(this->segments, value.u16, FALSE);
-                               }
-                               break;
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Process messages of type STATUS
- */
-static void process_status(private_ha_dispatcher_t *this,
-                                                  ha_message_t *message)
-{
-       ha_message_attribute_t attribute;
-       ha_message_value_t value;
-       enumerator_t *enumerator;
-       segment_mask_t mask = 0;
-
-       enumerator = message->create_attribute_enumerator(message);
-       while (enumerator->enumerate(enumerator, &attribute, &value))
-       {
-               switch (attribute)
-               {
-                       case HA_SEGMENT:
-                               mask |= SEGMENTS_BIT(value.u16);
-                               break;
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-
-       this->segments->handle_status(this->segments, mask);
-}
-
-/**
- * Process messages of type RESYNC
- */
-static void process_resync(private_ha_dispatcher_t *this,
-                                                  ha_message_t *message)
-{
-       ha_message_attribute_t attribute;
-       ha_message_value_t value;
-       enumerator_t *enumerator;
-
-       enumerator = message->create_attribute_enumerator(message);
-       while (enumerator->enumerate(enumerator, &attribute, &value))
-       {
-               switch (attribute)
-               {
-                       case HA_SEGMENT:
-                               this->segments->resync(this->segments, value.u16);
-                               break;
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Dispatcher job function
- */
-static job_requeue_t dispatch(private_ha_dispatcher_t *this)
-{
-       ha_message_t *message;
-
-       message = this->socket->pull(this->socket);
-       switch (message->get_type(message))
-       {
-               case HA_IKE_ADD:
-                       process_ike_add(this, message);
-                       break;
-               case HA_IKE_UPDATE:
-                       process_ike_update(this, message);
-                       break;
-               case HA_IKE_DELETE:
-                       process_ike_delete(this, message);
-                       break;
-               case HA_CHILD_ADD:
-                       process_child_add(this, message);
-                       break;
-               case HA_CHILD_DELETE:
-                       process_child_delete(this, message);
-                       break;
-               case HA_SEGMENT_DROP:
-                       process_segment(this, message, FALSE);
-                       break;
-               case HA_SEGMENT_TAKE:
-                       process_segment(this, message, TRUE);
-                       break;
-               case HA_STATUS:
-                       process_status(this, message);
-                       break;
-               case HA_RESYNC:
-                       process_resync(this, message);
-                       break;
-               default:
-                       DBG1(DBG_CFG, "received unknown HA message type %d",
-                                message->get_type(message));
-                       break;
-       }
-       message->destroy(message);
-
-       return JOB_REQUEUE_DIRECT;
-}
-
-/**
- * Implementation of ha_dispatcher_t.destroy.
- */
-static void destroy(private_ha_dispatcher_t *this)
-{
-       this->job->cancel(this->job);
-       free(this);
-}
-
-/**
- * See header
- */
-ha_dispatcher_t *ha_dispatcher_create(ha_socket_t *socket,
-                                                                         ha_segments_t *segments)
-{
-       private_ha_dispatcher_t *this = malloc_thing(private_ha_dispatcher_t);
-
-       this->public.destroy = (void(*)(ha_dispatcher_t*))destroy;
-
-       this->socket = socket;
-       this->segments = segments;
-       this->job = callback_job_create((callback_job_cb_t)dispatch,
-                                                                       this, NULL, NULL);
-       charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
-       return &this->public;
-}
-
diff --git a/src/charon/plugins/ha/ha_dispatcher.h b/src/charon/plugins/ha/ha_dispatcher.h
deleted file mode 100644 (file)
index d2baace..0000000
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha_dispatcher ha_dispatcher
- * @{ @ingroup ha
- */
-
-#ifndef HA_DISPATCHER_H_
-#define HA_DISPATCHER_H_
-
-#include "ha_socket.h"
-#include "ha_segments.h"
-
-typedef struct ha_dispatcher_t ha_dispatcher_t;
-
-/**
- * The dispatcher pulls messages in a thread an processes them.
- */
-struct ha_dispatcher_t {
-
-       /**
-        * Destroy a ha_dispatcher_t.
-        */
-       void (*destroy)(ha_dispatcher_t *this);
-};
-
-/**
- * Create a ha_dispatcher instance pulling from socket.
- *
- * @param socket               socket to pull messages from
- * @param segments             segments to control based on received messages
- * @return                             dispatcher object
- */
-ha_dispatcher_t *ha_dispatcher_create(ha_socket_t *socket,
-                                                                         ha_segments_t *segments);
-
-#endif /* HA_DISPATCHER_ @}*/
diff --git a/src/charon/plugins/ha/ha_ike.c b/src/charon/plugins/ha/ha_ike.c
deleted file mode 100644 (file)
index 501c79b..0000000
+++ /dev/null
@@ -1,286 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ha_ike.h"
-
-typedef struct private_ha_ike_t private_ha_ike_t;
-
-/**
- * Private data of an ha_ike_t object.
- */
-struct private_ha_ike_t {
-
-       /**
-        * Public ha_ike_t interface.
-        */
-       ha_ike_t public;
-
-       /**
-        * socket we use for syncing
-        */
-       ha_socket_t *socket;
-
-       /**
-        * tunnel securing sync messages
-        */
-       ha_tunnel_t *tunnel;
-};
-
-/**
- * Return condition if it is set on ike_sa
- */
-static ike_condition_t copy_condition(ike_sa_t *ike_sa, ike_condition_t cond)
-{
-       if (ike_sa->has_condition(ike_sa, cond))
-       {
-               return cond;
-       }
-       return 0;
-}
-
-/**
- * Return extension if it is supported by peers IKE_SA
- */
-static ike_extension_t copy_extension(ike_sa_t *ike_sa, ike_extension_t ext)
-{
-       if (ike_sa->supports_extension(ike_sa, ext))
-       {
-               return ext;
-       }
-       return 0;
-}
-
-/**
- * Implementation of listener_t.ike_keys
- */
-static bool ike_keys(private_ha_ike_t *this, ike_sa_t *ike_sa,
-                                        diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r,
-                                        ike_sa_t *rekey)
-{
-       ha_message_t *m;
-       chunk_t secret;
-       proposal_t *proposal;
-       u_int16_t alg, len;
-
-       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
-       {       /* do not sync SA between nodes */
-               return TRUE;
-       }
-       if (dh->get_shared_secret(dh, &secret) != SUCCESS)
-       {
-               return TRUE;
-       }
-
-       m = ha_message_create(HA_IKE_ADD);
-       m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
-
-       if (rekey)
-       {
-               chunk_t skd;
-               keymat_t *keymat;
-
-               keymat = rekey->get_keymat(rekey);
-               m->add_attribute(m, HA_IKE_REKEY_ID, rekey->get_id(rekey));
-               m->add_attribute(m, HA_ALG_OLD_PRF, keymat->get_skd(keymat, &skd));
-               m->add_attribute(m, HA_OLD_SKD, skd);
-       }
-
-       proposal = ike_sa->get_proposal(ike_sa);
-       if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &len))
-       {
-               m->add_attribute(m, HA_ALG_ENCR, alg);
-               if (len)
-               {
-                       m->add_attribute(m, HA_ALG_ENCR_LEN, len);
-               }
-       }
-       if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
-       {
-               m->add_attribute(m, HA_ALG_INTEG, alg);
-       }
-       if (proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL))
-       {
-               m->add_attribute(m, HA_ALG_PRF, alg);
-       }
-       m->add_attribute(m, HA_NONCE_I, nonce_i);
-       m->add_attribute(m, HA_NONCE_R, nonce_r);
-       m->add_attribute(m, HA_SECRET, secret);
-       chunk_clear(&secret);
-
-       this->socket->push(this->socket, m);
-
-       return TRUE;
-}
-
-/**
- * Implementation of listener_t.ike_updown
- */
-static bool ike_updown(private_ha_ike_t *this, ike_sa_t *ike_sa, bool up)
-{
-       ha_message_t *m;
-
-       if (ike_sa->get_state(ike_sa) == IKE_PASSIVE)
-       {       /* only sync active IKE_SAs */
-               return TRUE;
-       }
-       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
-       {       /* do not sync SA between nodes */
-               return TRUE;
-       }
-
-       if (up)
-       {
-               iterator_t *iterator;
-               peer_cfg_t *peer_cfg;
-               u_int32_t extension, condition;
-               host_t *addr;
-               identification_t *eap_id;
-               ike_sa_id_t *id;
-
-               peer_cfg = ike_sa->get_peer_cfg(ike_sa);
-
-               condition = copy_condition(ike_sa, COND_NAT_ANY)
-                                 | copy_condition(ike_sa, COND_NAT_HERE)
-                                 | copy_condition(ike_sa, COND_NAT_THERE)
-                                 | copy_condition(ike_sa, COND_NAT_FAKE)
-                                 | copy_condition(ike_sa, COND_EAP_AUTHENTICATED)
-                                 | copy_condition(ike_sa, COND_CERTREQ_SEEN)
-                                 | copy_condition(ike_sa, COND_ORIGINAL_INITIATOR);
-
-               extension = copy_extension(ike_sa, EXT_NATT)
-                                 | copy_extension(ike_sa, EXT_MOBIKE)
-                                 | copy_extension(ike_sa, EXT_HASH_AND_URL);
-
-               eap_id = ike_sa->get_eap_identity(ike_sa);
-               id = ike_sa->get_id(ike_sa);
-
-               m = ha_message_create(HA_IKE_UPDATE);
-               m->add_attribute(m, HA_IKE_ID, id);
-               m->add_attribute(m, HA_LOCAL_ID, ike_sa->get_my_id(ike_sa));
-               m->add_attribute(m, HA_REMOTE_ID, ike_sa->get_other_id(ike_sa));
-               m->add_attribute(m, HA_LOCAL_ADDR, ike_sa->get_my_host(ike_sa));
-               m->add_attribute(m, HA_REMOTE_ADDR, ike_sa->get_other_host(ike_sa));
-               m->add_attribute(m, HA_CONDITIONS, condition);
-               m->add_attribute(m, HA_EXTENSIONS, extension);
-               m->add_attribute(m, HA_CONFIG_NAME, peer_cfg->get_name(peer_cfg));
-               if (eap_id)
-               {
-                       m->add_attribute(m, HA_EAP_ID, eap_id);
-               }
-               iterator = ike_sa->create_additional_address_iterator(ike_sa);
-               while (iterator->iterate(iterator, (void**)&addr))
-               {
-                       m->add_attribute(m, HA_ADDITIONAL_ADDR, addr);
-               }
-               iterator->destroy(iterator);
-       }
-       else
-       {
-               m = ha_message_create(HA_IKE_DELETE);
-               m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
-       }
-       this->socket->push(this->socket, m);
-       return TRUE;
-}
-
-/**
- * Implementation of listener_t.ike_rekey
- */
-static bool ike_rekey(private_ha_ike_t *this, ike_sa_t *old, ike_sa_t *new)
-{
-       ike_updown(this, old, FALSE);
-       ike_updown(this, new, TRUE);
-       return TRUE;
-}
-
-/**
- * Implementation of listener_t.message
- */
-static bool message_hook(private_ha_ike_t *this, ike_sa_t *ike_sa,
-                                                message_t *message, bool incoming)
-{
-       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
-       {       /* do not sync SA between nodes */
-               return TRUE;
-       }
-
-       if (message->get_exchange_type(message) != IKE_SA_INIT &&
-               message->get_request(message))
-       {       /* we sync on requests, but skip it on IKE_SA_INIT */
-               ha_message_t *m;
-               u_int32_t mid;
-
-               m = ha_message_create(HA_IKE_UPDATE);
-               m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
-               mid = message->get_message_id(message) + 1;
-               if (incoming)
-               {
-                       m->add_attribute(m, HA_RESPOND_MID, mid);
-               }
-               else
-               {
-                       m->add_attribute(m, HA_INITIATE_MID, mid);
-               }
-               this->socket->push(this->socket, m);
-       }
-       if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
-               message->get_exchange_type(message) == IKE_AUTH &&
-               !message->get_request(message))
-       {       /* After IKE_SA has been established, sync peers virtual IP.
-                * We cannot sync it in the state_change hook, it is installed later.
-                * TODO: where to sync local VIP? */
-               ha_message_t *m;
-               host_t *vip;
-
-               vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
-               if (vip)
-               {
-                       m = ha_message_create(HA_IKE_UPDATE);
-                       m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
-                       m->add_attribute(m, HA_REMOTE_VIP, vip);
-                       this->socket->push(this->socket, m);
-               }
-       }
-       return TRUE;
-}
-
-/**
- * Implementation of ha_ike_t.destroy.
- */
-static void destroy(private_ha_ike_t *this)
-{
-       free(this);
-}
-
-/**
- * See header
- */
-ha_ike_t *ha_ike_create(ha_socket_t *socket, ha_tunnel_t *tunnel)
-{
-       private_ha_ike_t *this = malloc_thing(private_ha_ike_t);
-
-       memset(&this->public.listener, 0, sizeof(listener_t));
-       this->public.listener.ike_keys = (bool(*)(listener_t*, ike_sa_t *ike_sa, diffie_hellman_t *dh,chunk_t nonce_i, chunk_t nonce_r, ike_sa_t *rekey))ike_keys;
-       this->public.listener.ike_updown = (bool(*)(listener_t*,ike_sa_t *ike_sa, bool up))ike_updown;
-       this->public.listener.ike_rekey = (bool(*)(listener_t*,ike_sa_t *old, ike_sa_t *new))ike_rekey;
-       this->public.listener.message = (bool(*)(listener_t*, ike_sa_t *, message_t *,bool))message_hook;
-       this->public.destroy = (void(*)(ha_ike_t*))destroy;
-
-       this->socket = socket;
-       this->tunnel = tunnel;
-
-       return &this->public;
-}
-
diff --git a/src/charon/plugins/ha/ha_ike.h b/src/charon/plugins/ha/ha_ike.h
deleted file mode 100644 (file)
index 9de210e..0000000
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha_ike ha_ike
- * @{ @ingroup ha
- */
-
-#ifndef HA_IKE_H_
-#define HA_IKE_H_
-
-#include "ha_socket.h"
-#include "ha_tunnel.h"
-#include "ha_segments.h"
-
-#include <daemon.h>
-
-typedef struct ha_ike_t ha_ike_t;
-
-/**
- * Listener to synchronize IKE_SAs.
- */
-struct ha_ike_t {
-
-       /**
-        * Implements bus listener interface.
-        */
-       listener_t listener;
-
-       /**
-        * Destroy a ha_ike_t.
-        */
-       void (*destroy)(ha_ike_t *this);
-};
-
-/**
- * Create a ha_ike instance.
- *
- * @param socket               socket to use for sending synchronization messages
- * @param tunnel               tunnel securing sync messages, if any
- * @return                             IKE listener
- */
-ha_ike_t *ha_ike_create(ha_socket_t *socket, ha_tunnel_t *tunnel);
-
-#endif /* HA_IKE_ @}*/
diff --git a/src/charon/plugins/ha/ha_kernel.c b/src/charon/plugins/ha/ha_kernel.c
deleted file mode 100644 (file)
index 0ad9c22..0000000
+++ /dev/null
@@ -1,229 +0,0 @@
-/*
- * Copyright (C) 2009 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ha_kernel.h"
-
-typedef u_int32_t u32;
-typedef u_int8_t u8;
-
-#include <linux/jhash.h>
-#include <string.h>
-#include <errno.h>
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-
-#define CLUSTERIP_DIR "/proc/net/ipt_CLUSTERIP"
-
-typedef struct private_ha_kernel_t private_ha_kernel_t;
-
-/**
- * Private data of an ha_kernel_t object.
- */
-struct private_ha_kernel_t {
-
-       /**
-        * Public ha_kernel_t interface.
-        */
-       ha_kernel_t public;
-
-       /**
-        * Init value for jhash
-        */
-       u_int initval;
-
-       /**
-        * Total number of ClusterIP segments
-        */
-       u_int count;
-};
-
-/**
- * Implementation of ha_kernel_t.in_segment
- */
-static bool in_segment(private_ha_kernel_t *this, host_t *host, u_int segment)
-{
-       if (host->get_family(host) == AF_INET)
-       {
-               unsigned long hash;
-               u_int32_t addr;
-
-               addr = *(u_int32_t*)host->get_address(host).ptr;
-               hash = jhash_1word(ntohl(addr), this->initval);
-
-               if ((((u_int64_t)hash * this->count) >> 32) + 1 == segment)
-               {
-                       return TRUE;
-               }
-       }
-       return FALSE;
-}
-
-/**
- * Activate/Deactivate a segment for a given clusterip file
- */
-static void enable_disable(private_ha_kernel_t *this, u_int segment,
-                                                  char *file, bool enable)
-{
-       char cmd[8];
-       int fd;
-
-       snprintf(cmd, sizeof(cmd), "%c%d\n", enable ? '+' : '-', segment);
-
-       fd = open(file, O_WRONLY);
-       if (fd == -1)
-       {
-               DBG1(DBG_CFG, "opening CLUSTERIP file '%s' failed: %s",
-                        file, strerror(errno));
-               return;
-       }
-       if (write(fd, cmd, strlen(cmd) == -1))
-       {
-               DBG1(DBG_CFG, "writing to CLUSTERIP file '%s' failed: %s",
-                        file, strerror(errno));
-       }
-       close(fd);
-}
-
-/**
- * Get the currenlty active segments in the kernel for a clusterip file
- */
-static segment_mask_t get_active(private_ha_kernel_t *this, char *file)
-{
-       char buf[256];
-       segment_mask_t mask = 0;
-       ssize_t len;
-       int fd;
-
-       fd = open(file, O_RDONLY);
-       if (fd == -1)
-       {
-               DBG1(DBG_CFG, "opening CLUSTERIP file '%s' failed: %s",
-                        file, strerror(errno));
-               return 0;
-       }
-       len = read(fd, buf, sizeof(buf)-1);
-       if (len == -1)
-       {
-               DBG1(DBG_CFG, "reading from CLUSTERIP file '%s' failed: %s",
-                        file, strerror(errno));
-       }
-       else
-       {
-               enumerator_t *enumerator;
-               u_int segment;
-               char *token;
-
-               buf[len] = '\0';
-               enumerator = enumerator_create_token(buf, ",", " ");
-               while (enumerator->enumerate(enumerator, &token))
-               {
-                       segment = atoi(token);
-                       if (segment)
-                       {
-                               mask |= SEGMENTS_BIT(segment);
-                       }
-               }
-               enumerator->destroy(enumerator);
-       }
-       return mask;
-}
-
-/**
- * Implementation of ha_kernel_t.activate
- */
-static void activate(private_ha_kernel_t *this, u_int segment)
-{
-       enumerator_t *enumerator;
-       char *file;
-
-       enumerator = enumerator_create_directory(CLUSTERIP_DIR);
-       while (enumerator->enumerate(enumerator, NULL, &file, NULL))
-       {
-               enable_disable(this, segment, file, TRUE);
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Implementation of ha_kernel_t.deactivate
- */
-static void deactivate(private_ha_kernel_t *this, u_int segment)
-{
-       enumerator_t *enumerator;
-       char *file;
-
-       enumerator = enumerator_create_directory(CLUSTERIP_DIR);
-       while (enumerator->enumerate(enumerator, NULL, &file, NULL))
-       {
-               enable_disable(this, segment, file, FALSE);
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Disable all not-yet disabled segments on all clusterip addresses
- */
-static void disable_all(private_ha_kernel_t *this)
-{
-       enumerator_t *enumerator;
-       segment_mask_t active;
-       char *file;
-       int i;
-
-       enumerator = enumerator_create_directory(CLUSTERIP_DIR);
-       while (enumerator->enumerate(enumerator, NULL, &file, NULL))
-       {
-               active = get_active(this, file);
-               for (i = 1; i <= this->count; i++)
-               {
-                       if (active & SEGMENTS_BIT(i))
-                       {
-                               enable_disable(this, i, file, FALSE);
-                       }
-               }
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Implementation of ha_kernel_t.destroy.
- */
-static void destroy(private_ha_kernel_t *this)
-{
-       free(this);
-}
-
-/**
- * See header
- */
-ha_kernel_t *ha_kernel_create(u_int count)
-{
-       private_ha_kernel_t *this = malloc_thing(private_ha_kernel_t);
-
-       this->public.in_segment = (bool(*)(ha_kernel_t*, host_t *host, u_int segment))in_segment;
-       this->public.activate = (void(*)(ha_kernel_t*, u_int segment))activate;
-       this->public.deactivate = (void(*)(ha_kernel_t*, u_int segment))deactivate;
-       this->public.destroy = (void(*)(ha_kernel_t*))destroy;
-
-       this->initval = 0;
-       this->count = count;
-
-       disable_all(this);
-
-       return &this->public;
-}
-
diff --git a/src/charon/plugins/ha/ha_kernel.h b/src/charon/plugins/ha/ha_kernel.h
deleted file mode 100644 (file)
index b37cc76..0000000
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (C) 2009 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha_kernel ha_kernel
- * @{ @ingroup ha
- */
-
-#ifndef HA_KERNEL_H_
-#define HA_KERNEL_H_
-
-typedef struct ha_kernel_t ha_kernel_t;
-
-#include "ha_segments.h"
-
-/**
- * HA segment kernel configuration interface.
- */
-struct ha_kernel_t {
-
-       /**
-        * Check if a host is in a segment.
-        *
-        * @param host          host to check
-        * @param segment       segment
-        * @return                      TRUE if host belongs to segment
-        */
-       bool (*in_segment)(ha_kernel_t *this, host_t *host, u_int segment);
-
-       /**
-        * Activate a segment at kernel level for all cluster addresses.
-        *
-        * @param segment       segment to activate
-        */
-       void (*activate)(ha_kernel_t *this, u_int segment);
-
-       /**
-        * Deactivate a segment at kernel level for all cluster addresses.
-        *
-        * @param segment       segment to deactivate
-        */
-       void (*deactivate)(ha_kernel_t *this, u_int segment);
-
-       /**
-        * Destroy a ha_kernel_t.
-        */
-       void (*destroy)(ha_kernel_t *this);
-};
-
-/**
- * Create a ha_kernel instance.
- *
- * @param count                        total number of segments to use
- * @param active               bitmask of initially active segments
- */
-ha_kernel_t *ha_kernel_create(u_int count);
-
-#endif /* HA_KERNEL_ @}*/
diff --git a/src/charon/plugins/ha/ha_message.c b/src/charon/plugins/ha/ha_message.c
deleted file mode 100644 (file)
index cd6c90a..0000000
+++ /dev/null
@@ -1,665 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#define _GNU_SOURCE
-#include <string.h>
-#include <arpa/inet.h>
-
-#include "ha_message.h"
-
-#include <daemon.h>
-
-#define ALLOCATION_BLOCK 64
-
-typedef struct private_ha_message_t private_ha_message_t;
-
-/**
- * Private data of an ha_message_t object.
- */
-struct private_ha_message_t {
-
-       /**
-        * Public ha_message_t interface.
-        */
-       ha_message_t public;
-
-       /**
-        * Allocated size of buf
-        */
-       size_t allocated;
-
-       /**
-        * Buffer containing encoded data
-        */
-       chunk_t buf;
-};
-
-typedef struct ike_sa_id_encoding_t ike_sa_id_encoding_t;
-
-/**
- * Encoding if an ike_sa_id_t
- */
-struct ike_sa_id_encoding_t {
-       u_int64_t initiator_spi;
-       u_int64_t responder_spi;
-       u_int8_t initiator;
-} __attribute__((packed));
-
-typedef struct identification_encoding_t identification_encoding_t;
-
-/**
- * Encoding of a identification_t
- */
-struct identification_encoding_t {
-       u_int8_t type;
-       u_int8_t len;
-       char encoding[];
-} __attribute__((packed));
-
-typedef struct host_encoding_t host_encoding_t;
-
-/**
- * encoding of a host_t
- */
-struct host_encoding_t {
-       u_int16_t port;
-       u_int8_t family;
-       char encoding[];
-} __attribute__((packed));
-
-typedef struct ts_encoding_t ts_encoding_t;
-
-/**
- * encoding of a traffic_selector_t
- */
-struct ts_encoding_t {
-       u_int8_t type;
-       u_int8_t protocol;
-       u_int16_t from_port;
-       u_int16_t to_port;
-       u_int8_t dynamic;
-       char encoding[];
-} __attribute__((packed));
-
-/**
- * Implementation of ha_message_t.get_type
- */
-static ha_message_type_t get_type(private_ha_message_t *this)
-{
-       return this->buf.ptr[1];
-}
-
-/**
- * check for space in buffer, increase if necessary
- */
-static void check_buf(private_ha_message_t *this, size_t len)
-{
-       int increased = 0;
-
-       while (this->buf.len + len > this->allocated)
-       {       /* double size */
-               this->allocated += ALLOCATION_BLOCK;
-               increased++;
-       }
-       if (increased)
-       {
-               this->buf.ptr = realloc(this->buf.ptr, this->allocated);
-       }
-}
-
-/**
- * Implementation of ha_message_t.add_attribute
- */
-static void add_attribute(private_ha_message_t *this,
-                                                 ha_message_attribute_t attribute, ...)
-{
-       size_t len;
-       va_list args;
-
-       check_buf(this, sizeof(u_int8_t));
-       this->buf.ptr[this->buf.len] = attribute;
-       this->buf.len += sizeof(u_int8_t);
-
-       va_start(args, attribute);
-       switch (attribute)
-       {
-               /* ike_sa_id_t* */
-               case HA_IKE_ID:
-               case HA_IKE_REKEY_ID:
-               {
-                       ike_sa_id_encoding_t *enc;
-                       ike_sa_id_t *id;
-
-                       id = va_arg(args, ike_sa_id_t*);
-                       check_buf(this, sizeof(ike_sa_id_encoding_t));
-                       enc = (ike_sa_id_encoding_t*)(this->buf.ptr + this->buf.len);
-                       this->buf.len += sizeof(ike_sa_id_encoding_t);
-                       enc->initiator = id->is_initiator(id);
-                       enc->initiator_spi = id->get_initiator_spi(id);
-                       enc->responder_spi = id->get_responder_spi(id);
-                       break;
-               }
-               /* identification_t* */
-               case HA_LOCAL_ID:
-               case HA_REMOTE_ID:
-               case HA_EAP_ID:
-               {
-                       identification_encoding_t *enc;
-                       identification_t *id;
-                       chunk_t data;
-
-                       id = va_arg(args, identification_t*);
-                       data = id->get_encoding(id);
-                       check_buf(this, sizeof(identification_encoding_t) + data.len);
-                       enc = (identification_encoding_t*)(this->buf.ptr + this->buf.len);
-                       this->buf.len += sizeof(identification_encoding_t) + data.len;
-                       enc->type = id->get_type(id);
-                       enc->len = data.len;
-                       memcpy(enc->encoding, data.ptr, data.len);
-                       break;
-               }
-               /* host_t* */
-               case HA_LOCAL_ADDR:
-               case HA_REMOTE_ADDR:
-               case HA_LOCAL_VIP:
-               case HA_REMOTE_VIP:
-               case HA_ADDITIONAL_ADDR:
-               {
-                       host_encoding_t *enc;
-                       host_t *host;
-                       chunk_t data;
-
-                       host = va_arg(args, host_t*);
-                       data = host->get_address(host);
-                       check_buf(this, sizeof(host_encoding_t) + data.len);
-                       enc = (host_encoding_t*)(this->buf.ptr + this->buf.len);
-                       this->buf.len += sizeof(host_encoding_t) + data.len;
-                       enc->family = host->get_family(host);
-                       enc->port = htons(host->get_port(host));
-                       memcpy(enc->encoding, data.ptr, data.len);
-                       break;
-               }
-               /* char* */
-               case HA_CONFIG_NAME:
-               {
-                       char *str;
-
-                       str = va_arg(args, char*);
-                       len = strlen(str) + 1;
-                       check_buf(this, len);
-                       memcpy(this->buf.ptr + this->buf.len, str, len);
-                       this->buf.len += len;
-                       break;
-               }
-               /* u_int8_t */
-               case HA_IPSEC_MODE:
-               case HA_IPCOMP:
-               {
-                       u_int8_t val;
-
-                       val = va_arg(args, u_int);
-                       check_buf(this, sizeof(val));
-                       this->buf.ptr[this->buf.len] = val;
-                       this->buf.len += sizeof(val);
-                       break;
-               }
-               /* u_int16_t */
-               case HA_ALG_PRF:
-               case HA_ALG_OLD_PRF:
-               case HA_ALG_ENCR:
-               case HA_ALG_ENCR_LEN:
-               case HA_ALG_INTEG:
-               case HA_INBOUND_CPI:
-               case HA_OUTBOUND_CPI:
-               case HA_SEGMENT:
-               {
-                       u_int16_t val;
-
-                       val = va_arg(args, u_int);
-                       check_buf(this, sizeof(val));
-                       *(u_int16_t*)(this->buf.ptr + this->buf.len) = htons(val);
-                       this->buf.len += sizeof(val);
-                       break;
-               }
-               /** u_int32_t */
-               case HA_CONDITIONS:
-               case HA_EXTENSIONS:
-               case HA_INBOUND_SPI:
-               case HA_OUTBOUND_SPI:
-               case HA_INITIATE_MID:
-               case HA_RESPOND_MID:
-               {
-                       u_int32_t val;
-
-                       val = va_arg(args, u_int);
-                       check_buf(this, sizeof(val));
-                       *(u_int32_t*)(this->buf.ptr + this->buf.len) = htonl(val);
-                       this->buf.len += sizeof(val);
-                       break;
-               }
-               /** chunk_t */
-               case HA_NONCE_I:
-               case HA_NONCE_R:
-               case HA_SECRET:
-               case HA_OLD_SKD:
-               {
-                       chunk_t chunk;
-
-                       chunk = va_arg(args, chunk_t);
-                       check_buf(this, chunk.len + sizeof(u_int16_t));
-                       *(u_int16_t*)(this->buf.ptr + this->buf.len) = htons(chunk.len);
-                       memcpy(this->buf.ptr + this->buf.len + sizeof(u_int16_t),
-                                  chunk.ptr, chunk.len);
-                       this->buf.len += chunk.len + sizeof(u_int16_t);;
-                       break;
-               }
-               /** traffic_selector_t */
-               case HA_LOCAL_TS:
-               case HA_REMOTE_TS:
-               {
-                       ts_encoding_t *enc;
-                       traffic_selector_t *ts;
-                       chunk_t data;
-
-                       ts = va_arg(args, traffic_selector_t*);
-                       data = chunk_cata("cc", ts->get_from_address(ts),
-                                                         ts->get_to_address(ts));
-                       check_buf(this, sizeof(ts_encoding_t) + data.len);
-                       enc = (ts_encoding_t*)(this->buf.ptr + this->buf.len);
-                       this->buf.len += sizeof(ts_encoding_t) + data.len;
-                       enc->type = ts->get_type(ts);
-                       enc->protocol = ts->get_protocol(ts);
-                       enc->from_port = htons(ts->get_from_port(ts));
-                       enc->to_port = htons(ts->get_to_port(ts));
-                       enc->dynamic = ts->is_dynamic(ts);
-                       memcpy(enc->encoding, data.ptr, data.len);
-                       break;
-               }
-               default:
-               {
-                       DBG1(DBG_CFG, "unable to encode, attribute %d unknown", attribute);
-                       this->buf.len -= sizeof(u_int8_t);
-                       break;
-               }
-       }
-       va_end(args);
-}
-
-/**
- * Attribute enumerator implementation
- */
-typedef struct {
-       /** implementes enumerator_t */
-       enumerator_t public;
-       /** position in message */
-       chunk_t buf;
-       /** cleanup handler of current element, if any */
-       void (*cleanup)(void* data);
-       /** data to pass to cleanup handler */
-       void *cleanup_data;
-} attribute_enumerator_t;
-
-/**
- * Implementation of create_attribute_enumerator().enumerate
- */
-static bool attribute_enumerate(attribute_enumerator_t *this,
-                                                               ha_message_attribute_t *attr_out,
-                                                               ha_message_value_t *value)
-{
-       ha_message_attribute_t attr;
-
-       if (this->cleanup)
-       {
-               this->cleanup(this->cleanup_data);
-               this->cleanup = NULL;
-       }
-       if (this->buf.len < 1)
-       {
-               return FALSE;
-       }
-       attr = this->buf.ptr[0];
-       this->buf = chunk_skip(this->buf, 1);
-       switch (attr)
-       {
-               /* ike_sa_id_t* */
-               case HA_IKE_ID:
-               case HA_IKE_REKEY_ID:
-               {
-                       ike_sa_id_encoding_t *enc;
-
-                       if (this->buf.len < sizeof(ike_sa_id_encoding_t))
-                       {
-                               return FALSE;
-                       }
-                       enc = (ike_sa_id_encoding_t*)(this->buf.ptr);
-                       value->ike_sa_id = ike_sa_id_create(enc->initiator_spi,
-                                                                                       enc->responder_spi, enc->initiator);
-                       *attr_out = attr;
-                       this->cleanup = (void*)value->ike_sa_id->destroy;
-                       this->cleanup_data = value->ike_sa_id;
-                       this->buf = chunk_skip(this->buf, sizeof(ike_sa_id_encoding_t));
-                       return TRUE;
-               }
-               /* identification_t* */
-               case HA_LOCAL_ID:
-               case HA_REMOTE_ID:
-               case HA_EAP_ID:
-               {
-                       identification_encoding_t *enc;
-
-                       enc = (identification_encoding_t*)(this->buf.ptr);
-                       if (this->buf.len < sizeof(identification_encoding_t) ||
-                               this->buf.len < sizeof(identification_encoding_t) + enc->len)
-                       {
-                               return FALSE;
-                       }
-                       value->id = identification_create_from_encoding(enc->type,
-                                                                               chunk_create(enc->encoding, enc->len));
-                       *attr_out = attr;
-                       this->cleanup = (void*)value->id->destroy;
-                       this->cleanup_data = value->id;
-                       this->buf = chunk_skip(this->buf,
-                                                               sizeof(identification_encoding_t) + enc->len);
-                       return TRUE;
-               }
-               /* host_t* */
-               case HA_LOCAL_ADDR:
-               case HA_REMOTE_ADDR:
-               case HA_LOCAL_VIP:
-               case HA_REMOTE_VIP:
-               case HA_ADDITIONAL_ADDR:
-               {
-                       host_encoding_t *enc;
-
-                       enc = (host_encoding_t*)(this->buf.ptr);
-                       if (this->buf.len < sizeof(host_encoding_t))
-                       {
-                               return FALSE;
-                       }
-                       value->host = host_create_from_chunk(enc->family,
-                                                                       chunk_create(enc->encoding,
-                                                                               this->buf.len - sizeof(host_encoding_t)),
-                                                                       ntohs(enc->port));
-                       if (!value->host)
-                       {
-                               return FALSE;
-                       }
-                       *attr_out = attr;
-                       this->cleanup = (void*)value->host->destroy;
-                       this->cleanup_data = value->host;
-                       this->buf = chunk_skip(this->buf, sizeof(host_encoding_t) +
-                                                                  value->host->get_address(value->host).len);
-                       return TRUE;
-               }
-               /* char* */
-               case HA_CONFIG_NAME:
-               {
-                       size_t len;
-
-                       len = strnlen(this->buf.ptr, this->buf.len);
-                       if (len >= this->buf.len)
-                       {
-                               return FALSE;
-                       }
-                       value->str = this->buf.ptr;
-                       *attr_out = attr;
-                       this->buf = chunk_skip(this->buf, len + 1);
-                       return TRUE;
-               }
-               /* u_int8_t */
-               case HA_IPSEC_MODE:
-               case HA_IPCOMP:
-               {
-                       if (this->buf.len < sizeof(u_int8_t))
-                       {
-                               return FALSE;
-                       }
-                       value->u8 = *(u_int8_t*)this->buf.ptr;
-                       *attr_out = attr;
-                       this->buf = chunk_skip(this->buf, sizeof(u_int8_t));
-                       return TRUE;
-               }
-               /** u_int16_t */
-               case HA_ALG_PRF:
-               case HA_ALG_OLD_PRF:
-               case HA_ALG_ENCR:
-               case HA_ALG_ENCR_LEN:
-               case HA_ALG_INTEG:
-               case HA_INBOUND_CPI:
-               case HA_OUTBOUND_CPI:
-               case HA_SEGMENT:
-               {
-                       if (this->buf.len < sizeof(u_int16_t))
-                       {
-                               return FALSE;
-                       }
-                       value->u16 = ntohs(*(u_int16_t*)this->buf.ptr);
-                       *attr_out = attr;
-                       this->buf = chunk_skip(this->buf, sizeof(u_int16_t));
-                       return TRUE;
-               }
-               /** u_int32_t */
-               case HA_CONDITIONS:
-               case HA_EXTENSIONS:
-               case HA_INBOUND_SPI:
-               case HA_OUTBOUND_SPI:
-               case HA_INITIATE_MID:
-               case HA_RESPOND_MID:
-               {
-                       if (this->buf.len < sizeof(u_int32_t))
-                       {
-                               return FALSE;
-                       }
-                       value->u32 = ntohl(*(u_int32_t*)this->buf.ptr);
-                       *attr_out = attr;
-                       this->buf = chunk_skip(this->buf, sizeof(u_int32_t));
-                       return TRUE;
-               }
-               /** chunk_t */
-               case HA_NONCE_I:
-               case HA_NONCE_R:
-               case HA_SECRET:
-               case HA_OLD_SKD:
-               {
-                       size_t len;
-
-                       if (this->buf.len < sizeof(u_int16_t))
-                       {
-                               return FALSE;
-                       }
-                       len = ntohs(*(u_int16_t*)this->buf.ptr);
-                       this->buf = chunk_skip(this->buf, sizeof(u_int16_t));
-                       if (this->buf.len < len)
-                       {
-                               return FALSE;
-                       }
-                       value->chunk.len = len;
-                       value->chunk.ptr = this->buf.ptr;
-                       *attr_out = attr;
-                       this->buf = chunk_skip(this->buf, len);
-                       return TRUE;
-               }
-               case HA_LOCAL_TS:
-               case HA_REMOTE_TS:
-               {
-                       ts_encoding_t *enc;
-                       host_t *host;
-                       int addr_len;
-
-                       enc = (ts_encoding_t*)(this->buf.ptr);
-                       if (this->buf.len < sizeof(ts_encoding_t))
-                       {
-                               return FALSE;
-                       }
-                       switch (enc->type)
-                       {
-                               case TS_IPV4_ADDR_RANGE:
-                                       addr_len = 4;
-                                       if (this->buf.len < sizeof(ts_encoding_t) + 2 * addr_len)
-                                       {
-                                               return FALSE;
-                                       }
-                                       break;
-                               case TS_IPV6_ADDR_RANGE:
-                                       addr_len = 16;
-                                       if (this->buf.len < sizeof(ts_encoding_t) + 2 * addr_len)
-                                       {
-                                               return FALSE;
-                                       }
-                                       break;
-                               default:
-                                       return FALSE;
-                       }
-                       if (enc->dynamic)
-                       {
-                               host = host_create_from_chunk(0,
-                                                                       chunk_create(enc->encoding, addr_len), 0);
-                               if (!host)
-                               {
-                                       return FALSE;
-                               }
-                               value->ts = traffic_selector_create_dynamic(enc->protocol,
-                                                                       ntohs(enc->from_port), ntohs(enc->to_port));
-                               value->ts->set_address(value->ts, host);
-                               host->destroy(host);
-                       }
-                       else
-                       {
-                               value->ts = traffic_selector_create_from_bytes(enc->protocol,
-                                                               enc->type, chunk_create(enc->encoding, addr_len),
-                                                               ntohs(enc->from_port),
-                                                               chunk_create(enc->encoding + addr_len, addr_len),
-                                                               ntohs(enc->to_port));
-                               if (!value->ts)
-                               {
-                                       return FALSE;
-                               }
-                       }
-                       *attr_out = attr;
-                       this->cleanup = (void*)value->ts->destroy;
-                       this->cleanup_data = value->ts;
-                       this->buf = chunk_skip(this->buf, sizeof(ts_encoding_t)
-                                                                               + addr_len * 2);
-                       return TRUE;
-               }
-               default:
-               {
-                       return FALSE;
-               }
-       }
-}
-
-/**
- * Implementation of create_attribute_enumerator().destroy
- */
-static void enum_destroy(attribute_enumerator_t *this)
-{
-       if (this->cleanup)
-       {
-               this->cleanup(this->cleanup_data);
-       }
-       free(this);
-}
-
-/**
- * Implementation of ha_message_t.create_attribute_enumerator
- */
-static enumerator_t* create_attribute_enumerator(private_ha_message_t *this)
-{
-       attribute_enumerator_t *e = malloc_thing(attribute_enumerator_t);
-
-       e->public.enumerate = (void*)attribute_enumerate;
-       e->public.destroy = (void*)enum_destroy;
-
-       e->buf = chunk_skip(this->buf, 2);
-       e->cleanup = NULL;
-       e->cleanup_data = NULL;
-
-       return &e->public;
-}
-
-/**
- * Implementation of ha_message_t.get_encoding
- */
-static chunk_t get_encoding(private_ha_message_t *this)
-{
-       return this->buf;
-}
-
-/**
- * Implementation of ha_message_t.destroy.
- */
-static void destroy(private_ha_message_t *this)
-{
-       free(this->buf.ptr);
-       free(this);
-}
-
-
-static private_ha_message_t *ha_message_create_generic()
-{
-       private_ha_message_t *this = malloc_thing(private_ha_message_t);
-
-       this->public.get_type = (ha_message_type_t(*)(ha_message_t*))get_type;
-       this->public.add_attribute = (void(*)(ha_message_t*, ha_message_attribute_t attribute, ...))add_attribute;
-       this->public.create_attribute_enumerator = (enumerator_t*(*)(ha_message_t*))create_attribute_enumerator;
-       this->public.get_encoding = (chunk_t(*)(ha_message_t*))get_encoding;
-       this->public.destroy = (void(*)(ha_message_t*))destroy;
-
-       return this;
-}
-
-/**
- * See header
- */
-ha_message_t *ha_message_create(ha_message_type_t type)
-{
-       private_ha_message_t *this = ha_message_create_generic();
-
-       this->allocated = ALLOCATION_BLOCK;
-       this->buf.ptr = malloc(this->allocated);
-       this->buf.len = 2;
-       this->buf.ptr[0] = HA_MESSAGE_VERSION;
-       this->buf.ptr[1] = type;
-
-       return &this->public;
-}
-
-/**
- * See header
- */
-ha_message_t *ha_message_parse(chunk_t data)
-{
-       private_ha_message_t *this;
-
-       if (data.len < 2)
-       {
-               DBG1(DBG_CFG, "HA message too short");
-               return NULL;
-       }
-       if (data.ptr[0] != HA_MESSAGE_VERSION)
-       {
-               DBG1(DBG_CFG, "HA message has version %d, expected %d",
-                        data.ptr[0], HA_MESSAGE_VERSION);
-               return NULL;
-       }
-
-       this = ha_message_create_generic();
-       this->buf = chunk_clone(data);
-       this->allocated = this->buf.len;
-
-       return &this->public;
-}
-
diff --git a/src/charon/plugins/ha/ha_message.h b/src/charon/plugins/ha/ha_message.h
deleted file mode 100644 (file)
index 6204132..0000000
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha_message ha_message
- * @{ @ingroup ha
- */
-
-#ifndef HA_MESSAGE_H_
-#define HA_MESSAGE_H_
-
-#include <library.h>
-#include <utils/host.h>
-#include <utils/identification.h>
-#include <sa/ike_sa_id.h>
-#include <config/traffic_selector.h>
-
-/**
- * Protocol version of this implementation
- */
-#define HA_MESSAGE_VERSION 1
-
-typedef struct ha_message_t ha_message_t;
-typedef enum ha_message_type_t ha_message_type_t;
-typedef enum ha_message_attribute_t ha_message_attribute_t;
-typedef union ha_message_value_t ha_message_value_t;
-
-/**
- * Type of a HA message
- */
-enum ha_message_type_t {
-       /** add a completely new IKE_SA */
-       HA_IKE_ADD = 1,
-       /** update an existing IKE_SA (message IDs, address update, ...) */
-       HA_IKE_UPDATE,
-       /** delete an existing IKE_SA */
-       HA_IKE_DELETE,
-       /** add a new CHILD_SA */
-       HA_CHILD_ADD,
-       /** delete an existing CHILD_SA */
-       HA_CHILD_DELETE,
-       /** segments the sending node is giving up */
-       HA_SEGMENT_DROP,
-       /** segments the sending node is taking over */
-       HA_SEGMENT_TAKE,
-       /** status with the segments the sending node is currently serving */
-       HA_STATUS,
-       /** segments the receiving node is requested to resync */
-       HA_RESYNC,
-};
-
-/**
- * Type of attributes contained in a message
- */
-enum ha_message_attribute_t {
-       /** ike_sa_id_t*, to identify IKE_SA */
-       HA_IKE_ID = 1,
-       /** ike_Sa_id_t*, identifies IKE_SA which gets rekeyed */
-       HA_IKE_REKEY_ID,
-       /** identification_t*, local identity */
-       HA_LOCAL_ID,
-       /** identification_t*, remote identity */
-       HA_REMOTE_ID,
-       /** identification_t*, EAP identity */
-       HA_EAP_ID,
-       /** host_t*, local address */
-       HA_LOCAL_ADDR,
-       /** host_t*, remote address */
-       HA_REMOTE_ADDR,
-       /** char*, name of configuration */
-       HA_CONFIG_NAME,
-       /** u_int32_t, bitset of ike_condition_t */
-       HA_CONDITIONS,
-       /** u_int32_t, bitset of ike_extension_t */
-       HA_EXTENSIONS,
-       /** host_t*, local virtual IP */
-       HA_LOCAL_VIP,
-       /** host_t*, remote virtual IP */
-       HA_REMOTE_VIP,
-       /** host_t*, additional MOBIKE peer address */
-       HA_ADDITIONAL_ADDR,
-       /** chunk_t, initiators nonce */
-       HA_NONCE_I,
-       /** chunk_t, responders nonce */
-       HA_NONCE_R,
-       /** chunk_t, diffie hellman shared secret */
-       HA_SECRET,
-       /** chunk_t, SKd of old SA if rekeying */
-       HA_OLD_SKD,
-       /** u_int16_t, pseudo random function */
-       HA_ALG_PRF,
-       /** u_int16_t, old pseudo random function if rekeying */
-       HA_ALG_OLD_PRF,
-       /** u_int16_t, encryption algorithm */
-       HA_ALG_ENCR,
-       /** u_int16_t, encryption key size in bytes */
-       HA_ALG_ENCR_LEN,
-       /** u_int16_t, integrity protection algorithm */
-       HA_ALG_INTEG,
-       /** u_int8_t, IPsec mode, TUNNEL|TRANSPORT|... */
-       HA_IPSEC_MODE,
-       /** u_int8_t, IPComp protocol */
-       HA_IPCOMP,
-       /** u_int32_t, inbound security parameter index */
-       HA_INBOUND_SPI,
-       /** u_int32_t, outbound security parameter index */
-       HA_OUTBOUND_SPI,
-       /** u_int16_t, inbound security parameter index */
-       HA_INBOUND_CPI,
-       /** u_int16_t, outbound security parameter index */
-       HA_OUTBOUND_CPI,
-       /** traffic_selector_t*, local traffic selector */
-       HA_LOCAL_TS,
-       /** traffic_selector_t*, remote traffic selector */
-       HA_REMOTE_TS,
-       /** u_int32_t, initiating message ID */
-       HA_INITIATE_MID,
-       /** u_int32_t, responding message ID */
-       HA_RESPOND_MID,
-       /** u_int16_t, HA segment */
-       HA_SEGMENT,
-};
-
-/**
- * Union to enumerate typed attributes in a message
- */
-union ha_message_value_t {
-       u_int8_t u8;
-       u_int16_t u16;
-       u_int32_t u32;
-       char *str;
-       chunk_t chunk;
-       ike_sa_id_t *ike_sa_id;
-       identification_t *id;
-       host_t *host;
-       traffic_selector_t *ts;
-};
-
-/**
- * Abstracted message passed between nodes in a HA cluster.
- */
-struct ha_message_t {
-
-       /**
-        * Get the type of the message.
-        *
-        * @return              message type
-        */
-       ha_message_type_t (*get_type)(ha_message_t *this);
-
-       /**
-        * Add an attribute to a message.
-        *
-        * @param attribute             attribute type to add
-        * @param ...                   attribute specific data
-        */
-       void (*add_attribute)(ha_message_t *this,
-                                                 ha_message_attribute_t attribute, ...);
-
-       /**
-        * Create an enumerator over all attributes in a message.
-        *
-        * @return                              enumerator over attribute, ha_message_value_t
-        */
-       enumerator_t* (*create_attribute_enumerator)(ha_message_t *this);
-
-       /**
-        * Get the message in a encoded form.
-        *
-        * @return                              chunk pointing to internal data
-        */
-       chunk_t (*get_encoding)(ha_message_t *this);
-
-       /**
-        * Destroy a ha_message_t.
-        */
-       void (*destroy)(ha_message_t *this);
-};
-
-/**
- * Create a new ha_message instance, ready for adding attributes
- *
- * @param version                      protocol version to create a message from
- * @param type                         type of the message
- */
-ha_message_t *ha_message_create(ha_message_type_t type);
-
-/**
- * Create a ha_message from encoded data.
- *
- * @param data                         encoded message data
- */
-ha_message_t *ha_message_parse(chunk_t data);
-
-#endif /* HA_MESSAGE_ @}*/
diff --git a/src/charon/plugins/ha/ha_plugin.c b/src/charon/plugins/ha/ha_plugin.c
deleted file mode 100644 (file)
index 661db8a..0000000
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ha_plugin.h"
-#include "ha_ike.h"
-#include "ha_child.h"
-#include "ha_socket.h"
-#include "ha_tunnel.h"
-#include "ha_dispatcher.h"
-#include "ha_segments.h"
-#include "ha_ctl.h"
-
-#include <daemon.h>
-#include <config/child_cfg.h>
-
-typedef struct private_ha_plugin_t private_ha_plugin_t;
-
-/**
- * private data of ha plugin
- */
-struct private_ha_plugin_t {
-
-       /**
-        * implements plugin interface
-        */
-       ha_plugin_t public;
-
-       /**
-        * Communication socket
-        */
-       ha_socket_t *socket;
-
-       /**
-        * Tunnel securing sync messages.
-        */
-       ha_tunnel_t *tunnel;
-
-       /**
-        * IKE_SA synchronization
-        */
-       ha_ike_t *ike;
-
-       /**
-        * CHILD_SA synchronization
-        */
-       ha_child_t *child;
-
-       /**
-        * Dispatcher to process incoming messages
-        */
-       ha_dispatcher_t *dispatcher;
-
-       /**
-        * Active/Passive segment management
-        */
-       ha_segments_t *segments;
-
-       /**
-        * Interface to control segments at kernel level
-        */
-       ha_kernel_t *kernel;
-
-       /**
-        * Segment control interface via FIFO
-        */
-       ha_ctl_t *ctl;
-};
-
-/**
- * Implementation of plugin_t.destroy
- */
-static void destroy(private_ha_plugin_t *this)
-{
-       DESTROY_IF(this->ctl);
-       charon->bus->remove_listener(charon->bus, &this->segments->listener);
-       charon->bus->remove_listener(charon->bus, &this->ike->listener);
-       charon->bus->remove_listener(charon->bus, &this->child->listener);
-       this->ike->destroy(this->ike);
-       this->child->destroy(this->child);
-       this->dispatcher->destroy(this->dispatcher);
-       this->segments->destroy(this->segments);
-       this->kernel->destroy(this->kernel);
-       this->socket->destroy(this->socket);
-       DESTROY_IF(this->tunnel);
-       free(this);
-}
-
-/*
- * see header file
- */
-plugin_t *plugin_create()
-{
-       private_ha_plugin_t *this;
-       char *local, *remote, *secret;
-       u_int count;
-       bool fifo, monitor, resync;
-
-       local = lib->settings->get_str(lib->settings,
-                                                               "charon.plugins.ha.local", NULL);
-       remote = lib->settings->get_str(lib->settings,
-                                                               "charon.plugins.ha.remote", NULL);
-       secret = lib->settings->get_str(lib->settings,
-                                                               "charon.plugins.ha.secret", NULL);
-       fifo = lib->settings->get_bool(lib->settings,
-                                                               "charon.plugins.ha.fifo_interface", TRUE);
-       monitor = lib->settings->get_bool(lib->settings,
-                                                               "charon.plugins.ha.monitor", TRUE);
-       resync = lib->settings->get_bool(lib->settings,
-                                                               "charon.plugins.ha.resync", TRUE);
-       count = min(SEGMENTS_MAX, lib->settings->get_int(lib->settings,
-                                                               "charon.plugins.ha.segment_count", 1));
-       if (!local || !remote)
-       {
-               DBG1(DBG_CFG, "HA config misses local/remote address");
-               return NULL;
-       }
-
-       this = malloc_thing(private_ha_plugin_t);
-
-       this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-       this->tunnel = NULL;
-       this->ctl = NULL;
-
-       if (secret)
-       {
-               this->tunnel = ha_tunnel_create(local, remote, secret);
-       }
-       this->socket = ha_socket_create(local, remote);
-       if (!this->socket)
-       {
-               DESTROY_IF(this->tunnel);
-               free(this);
-               return NULL;
-       }
-       this->kernel = ha_kernel_create(count);
-       this->segments = ha_segments_create(this->socket, this->kernel, this->tunnel,
-                                                       count, strcmp(local, remote) > 0, monitor, resync);
-       if (fifo)
-       {
-               this->ctl = ha_ctl_create(this->segments);
-       }
-       this->dispatcher = ha_dispatcher_create(this->socket, this->segments);
-       this->ike = ha_ike_create(this->socket, this->tunnel);
-       this->child = ha_child_create(this->socket, this->tunnel);
-       charon->bus->add_listener(charon->bus, &this->segments->listener);
-       charon->bus->add_listener(charon->bus, &this->ike->listener);
-       charon->bus->add_listener(charon->bus, &this->child->listener);
-
-       return &this->public.plugin;
-}
-
diff --git a/src/charon/plugins/ha/ha_plugin.h b/src/charon/plugins/ha/ha_plugin.h
deleted file mode 100644 (file)
index e83712f..0000000
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha ha
- * @ingroup cplugins
- *
- * @defgroup ha_plugin ha_plugin
- * @{ @ingroup ha
- */
-
-#ifndef HA_PLUGIN_H_
-#define HA_PLUGIN_H_
-
-#include <plugins/plugin.h>
-
-/**
- * UDP port we use for communication
- */
-#define HA_PORT 4510
-
-typedef struct ha_plugin_t ha_plugin_t;
-
-/**
- * Plugin to synchronize state in a high availability cluster.
- */
-struct ha_plugin_t {
-
-       /**
-        * implements plugin interface
-        */
-       plugin_t plugin;
-};
-
-/**
- * Create a ha_plugin instance.
- */
-plugin_t *plugin_create();
-
-#endif /* HA_PLUGIN_H_ @}*/
diff --git a/src/charon/plugins/ha/ha_segments.c b/src/charon/plugins/ha/ha_segments.c
deleted file mode 100644 (file)
index 3575d05..0000000
+++ /dev/null
@@ -1,502 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ha_segments.h"
-
-#include <pthread.h>
-
-#include <utils/mutex.h>
-#include <utils/linked_list.h>
-#include <processing/jobs/callback_job.h>
-
-#define HEARTBEAT_DELAY 1000
-#define HEARTBEAT_TIMEOUT 2100
-
-typedef struct private_ha_segments_t private_ha_segments_t;
-
-/**
- * Private data of an ha_segments_t object.
- */
-struct private_ha_segments_t {
-
-       /**
-        * Public ha_segments_t interface.
-        */
-       ha_segments_t public;
-
-       /**
-        * communication socket
-        */
-       ha_socket_t *socket;
-
-       /**
-        * Sync tunnel, if any
-        */
-       ha_tunnel_t *tunnel;
-
-       /**
-        * Interface to control segments at kernel level
-        */
-       ha_kernel_t *kernel;
-
-       /**
-        * Mutex to lock segment manipulation
-        */
-       mutex_t *mutex;
-
-       /**
-        * Condvar to wait for heartbeats
-        */
-       condvar_t *condvar;
-
-       /**
-        * Job checking for heartbeats
-        */
-       callback_job_t *job;
-
-       /**
-        * Total number of ClusterIP segments
-        */
-       u_int count;
-
-       /**
-        * mask of active segments
-        */
-       segment_mask_t active;
-
-       /**
-        * Node number
-        */
-       u_int node;
-};
-
-/**
- * Log currently active segments
- */
-static void log_segments(private_ha_segments_t *this, bool activated,
-                                                u_int segment)
-{
-       char buf[64] = "none", *pos = buf;
-       int i;
-       bool first = TRUE;
-
-       for (i = 1; i <= this->count; i++)
-       {
-               if (this->active & SEGMENTS_BIT(i))
-               {
-                       if (first)
-                       {
-                               first = FALSE;
-                       }
-                       else
-                       {
-                               pos += snprintf(pos, buf + sizeof(buf) - pos, ",");
-                       }
-                       pos += snprintf(pos, buf + sizeof(buf) - pos, "%d", i);
-               }
-       }
-       DBG1(DBG_CFG, "HA segment %d %sactivated, now active: %s",
-                segment, activated ? "" : "de", buf);
-}
-
-/**
- * Enable/Disable a specific segment
- */
-static void enable_disable(private_ha_segments_t *this, u_int segment,
-                                                  bool enable, bool notify)
-{
-       ike_sa_t *ike_sa;
-       enumerator_t *enumerator;
-       ike_sa_state_t old, new;
-       ha_message_t *message = NULL;
-       ha_message_type_t type;
-       bool changes = FALSE;
-
-       if (segment > this->count)
-       {
-               return;
-       }
-
-       if (enable)
-       {
-               old = IKE_PASSIVE;
-               new = IKE_ESTABLISHED;
-               type = HA_SEGMENT_TAKE;
-               if (!(this->active & SEGMENTS_BIT(segment)))
-               {
-                       this->active |= SEGMENTS_BIT(segment);
-                       this->kernel->activate(this->kernel, segment);
-                       changes = TRUE;
-               }
-       }
-       else
-       {
-               old = IKE_ESTABLISHED;
-               new = IKE_PASSIVE;
-               type = HA_SEGMENT_DROP;
-               if (this->active & SEGMENTS_BIT(segment))
-               {
-                       this->active &= ~SEGMENTS_BIT(segment);
-                       this->kernel->deactivate(this->kernel, segment);
-                       changes = TRUE;
-               }
-       }
-
-       if (changes)
-       {
-               enumerator = charon->ike_sa_manager->create_enumerator(charon->ike_sa_manager);
-               while (enumerator->enumerate(enumerator, &ike_sa))
-               {
-                       if (ike_sa->get_state(ike_sa) != old)
-                       {
-                               continue;
-                       }
-                       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
-                       {
-                               continue;
-                       }
-                       if (this->kernel->in_segment(this->kernel,
-                                                                       ike_sa->get_other_host(ike_sa), segment))
-                       {
-                               ike_sa->set_state(ike_sa, new);
-                       }
-               }
-               enumerator->destroy(enumerator);
-               log_segments(this, enable, segment);
-       }
-
-       if (notify)
-       {
-               message = ha_message_create(type);
-               message->add_attribute(message, HA_SEGMENT, segment);
-               this->socket->push(this->socket, message);
-       }
-}
-
-/**
- * Enable/Disable all or a specific segment, do locking
- */
-static void enable_disable_all(private_ha_segments_t *this, u_int segment,
-                                                          bool enable, bool notify)
-{
-       int i;
-
-       this->mutex->lock(this->mutex);
-       if (segment == 0)
-       {
-               for (i = 1; i <= this->count; i++)
-               {
-                       enable_disable(this, i, enable, notify);
-               }
-       }
-       else
-       {
-               enable_disable(this, segment, enable, notify);
-       }
-       this->mutex->unlock(this->mutex);
-}
-
-/**
- * Implementation of ha_segments_t.activate
- */
-static void activate(private_ha_segments_t *this, u_int segment, bool notify)
-{
-       enable_disable_all(this, segment, TRUE, notify);
-}
-
-/**
- * Implementation of ha_segments_t.deactivate
- */
-static void deactivate(private_ha_segments_t *this, u_int segment, bool notify)
-{
-       enable_disable_all(this, segment, FALSE, notify);
-}
-
-/**
- * Rekey all children of an IKE_SA
- */
-static status_t rekey_children(ike_sa_t *ike_sa)
-{
-       iterator_t *iterator;
-       child_sa_t *child_sa;
-       status_t status = SUCCESS;
-
-       iterator = ike_sa->create_child_sa_iterator(ike_sa);
-       while (iterator->iterate(iterator, (void**)&child_sa))
-       {
-               DBG1(DBG_CFG, "resyncing CHILD_SA");
-               status = ike_sa->rekey_child_sa(ike_sa, child_sa->get_protocol(child_sa),
-                                                                               child_sa->get_spi(child_sa, TRUE));
-               if (status == DESTROY_ME)
-               {
-                       break;
-               }
-       }
-       iterator->destroy(iterator);
-       return status;
-}
-
-/**
- * Implementation of ha_segments_t.resync
- */
-static void resync(private_ha_segments_t *this, u_int segment)
-{
-       ike_sa_t *ike_sa;
-       enumerator_t *enumerator;
-       linked_list_t *list;
-       ike_sa_id_t *id;
-
-       list = linked_list_create();
-       this->mutex->lock(this->mutex);
-
-       if (segment > 0 && segment <= this->count)
-       {
-               DBG1(DBG_CFG, "resyncing HA segment %d", segment);
-
-               /* we do the actual rekeying in a seperate loop to avoid rekeying
-                * an SA twice. */
-               enumerator = charon->ike_sa_manager->create_enumerator(
-                                                                                                       charon->ike_sa_manager);
-               while (enumerator->enumerate(enumerator, &ike_sa))
-               {
-                       if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
-                               this->kernel->in_segment(this->kernel,
-                                                                       ike_sa->get_other_host(ike_sa), segment))
-                       {
-                               id = ike_sa->get_id(ike_sa);
-                               list->insert_last(list, id->clone(id));
-                       }
-               }
-               enumerator->destroy(enumerator);
-       }
-       this->mutex->unlock(this->mutex);
-
-       while (list->remove_last(list, (void**)&id) == SUCCESS)
-       {
-               ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, id);
-               id->destroy(id);
-               if (ike_sa)
-               {
-                       DBG1(DBG_CFG, "resyncing IKE_SA");
-                       if (ike_sa->rekey(ike_sa) != DESTROY_ME)
-                       {
-                               if (rekey_children(ike_sa) != DESTROY_ME)
-                               {
-                                       charon->ike_sa_manager->checkin(
-                                                                               charon->ike_sa_manager, ike_sa);
-                                       continue;
-                               }
-                       }
-                       charon->ike_sa_manager->checkin_and_destroy(
-                                                                               charon->ike_sa_manager, ike_sa);
-               }
-       }
-       list->destroy(list);
-}
-
-/**
- * Implementation of listener_t.alert
- */
-static bool alert_hook(private_ha_segments_t *this, ike_sa_t *ike_sa,
-                                          alert_t alert, va_list args)
-{
-       if (alert == ALERT_SHUTDOWN_SIGNAL)
-       {
-               deactivate(this, 0, TRUE);
-       }
-       return TRUE;
-}
-
-/**
- * Request a resync of all segments
- */
-static job_requeue_t request_resync(private_ha_segments_t *this)
-{
-       ha_message_t *message;
-       int i;
-
-       message = ha_message_create(HA_RESYNC);
-       for (i = 1; i <= this->count; i++)
-       {
-               message->add_attribute(message, HA_SEGMENT, i);
-       }
-       this->socket->push(this->socket, message);
-       return JOB_REQUEUE_NONE;
-}
-
-/**
- * Monitor heartbeat activity of remote node
- */
-static job_requeue_t watchdog(private_ha_segments_t *this)
-{
-       int oldstate;
-       bool timeout;
-
-       this->mutex->lock(this->mutex);
-       pthread_cleanup_push((void*)this->mutex->unlock, this->mutex);
-       pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
-       timeout = this->condvar->timed_wait(this->condvar, this->mutex,
-                                                                               HEARTBEAT_TIMEOUT);
-       pthread_setcancelstate(oldstate, NULL);
-       pthread_cleanup_pop(TRUE);
-       if (timeout)
-       {
-               DBG1(DBG_CFG, "no heartbeat received, taking all segments");
-               activate(this, 0, TRUE);
-               /* disable heartbeat detection util we get one */
-               this->job = NULL;
-               return JOB_REQUEUE_NONE;
-       }
-       return JOB_REQUEUE_DIRECT;
-}
-
-/**
- * Start the heartbeat detection thread
- */
-static void start_watchdog(private_ha_segments_t *this)
-{
-       this->job = callback_job_create((callback_job_cb_t)watchdog,
-                                                                       this, NULL, NULL);
-       charon->processor->queue_job(charon->processor, (job_t*)this->job);
-}
-
-/**
- * Implementation of ha_segments_t.handle_status
- */
-static void handle_status(private_ha_segments_t *this, segment_mask_t mask)
-{
-       segment_mask_t missing;
-       int i;
-
-       this->mutex->lock(this->mutex);
-
-       missing = ~(this->active | mask);
-
-       for (i = 1; i <= this->count; i++)
-       {
-               if (missing & SEGMENTS_BIT(i))
-               {
-                       if (this->node == i % 2)
-                       {
-                               DBG1(DBG_CFG, "HA segment %d was not handled, taking", i);
-                               enable_disable(this, i, TRUE, TRUE);
-                       }
-                       else
-                       {
-                               DBG1(DBG_CFG, "HA segment %d was not handled, dropping", i);
-                               enable_disable(this, i, FALSE, TRUE);
-                       }
-               }
-       }
-
-       this->mutex->unlock(this->mutex);
-       this->condvar->signal(this->condvar);
-
-       if (!this->job)
-       {
-               DBG1(DBG_CFG, "received heartbeat, reenabling watchdog");
-               start_watchdog(this);
-       }
-}
-
-/**
- * Send a status message with our active segments
- */
-static job_requeue_t send_status(private_ha_segments_t *this)
-{
-       ha_message_t *message;
-       int i;
-
-       message = ha_message_create(HA_STATUS);
-
-       for (i = 1; i <= this->count; i++)
-       {
-               if (this->active & SEGMENTS_BIT(i))
-               {
-                       message->add_attribute(message, HA_SEGMENT, i);
-               }
-       }
-
-       this->socket->push(this->socket, message);
-
-       /* schedule next invocation */
-       charon->scheduler->schedule_job_ms(charon->scheduler, (job_t*)
-                                                                       callback_job_create((callback_job_cb_t)
-                                                                               send_status, this, NULL, NULL),
-                                                                       HEARTBEAT_DELAY);
-
-       return JOB_REQUEUE_NONE;
-}
-
-/**
- * Implementation of ha_segments_t.destroy.
- */
-static void destroy(private_ha_segments_t *this)
-{
-       if (this->job)
-       {
-               this->job->cancel(this->job);
-       }
-       this->mutex->destroy(this->mutex);
-       this->condvar->destroy(this->condvar);
-       free(this);
-}
-
-/**
- * See header
- */
-ha_segments_t *ha_segments_create(ha_socket_t *socket, ha_kernel_t *kernel,
-                                                                 ha_tunnel_t *tunnel, u_int count, u_int node,
-                                                                 bool monitor, bool sync)
-{
-       private_ha_segments_t *this = malloc_thing(private_ha_segments_t);
-
-       memset(&this->public.listener, 0, sizeof(listener_t));
-       this->public.listener.alert = (bool(*)(listener_t*, ike_sa_t *, alert_t, va_list))alert_hook;
-       this->public.activate = (void(*)(ha_segments_t*, u_int segment,bool))activate;
-       this->public.deactivate = (void(*)(ha_segments_t*, u_int segment,bool))deactivate;
-       this->public.resync = (void(*)(ha_segments_t*, u_int segment))resync;
-       this->public.handle_status = (void(*)(ha_segments_t*, segment_mask_t mask))handle_status;
-       this->public.destroy = (void(*)(ha_segments_t*))destroy;
-
-       this->socket = socket;
-       this->tunnel = tunnel;
-       this->kernel = kernel;
-       this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
-       this->condvar = condvar_create(CONDVAR_TYPE_DEFAULT);
-       this->count = count;
-       this->node = node;
-       this->job = NULL;
-
-       /* initially all segments are deactivated */
-       this->active = 0;
-
-       if (monitor)
-       {
-               send_status(this);
-               start_watchdog(this);
-       }
-
-       if (sync)
-       {
-               /* request a resync as soon as we are up */
-               charon->processor->queue_job(charon->processor, (job_t*)
-                                               callback_job_create((callback_job_cb_t)request_resync,
-                                                                                       this, NULL, NULL));
-       }
-
-       return &this->public;
-}
-
diff --git a/src/charon/plugins/ha/ha_segments.h b/src/charon/plugins/ha/ha_segments.h
deleted file mode 100644 (file)
index 6d1cd54..0000000
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha_segments ha_segments
- * @{ @ingroup ha
- */
-
-#ifndef HA_SEGMENTS_H_
-#define HA_SEGMENTS_H_
-
-#include <daemon.h>
-
-typedef struct ha_segments_t ha_segments_t;
-
-typedef u_int16_t segment_mask_t;
-
-/**
- * maximum number of segments
- */
-#define SEGMENTS_MAX (sizeof(segment_mask_t)*8)
-
-/**
- * Get the bit in the mask of a segment
- */
-#define SEGMENTS_BIT(segment) (0x01 << (segment - 1))
-
-#include "ha_socket.h"
-#include "ha_tunnel.h"
-#include "ha_kernel.h"
-
-/**
- * Segmentation of peers into active and passive.
- */
-struct ha_segments_t {
-
-       /**
-        * Implements listener interface to catch daemon shutdown.
-        */
-       listener_t listener;
-
-       /**
-        * Activate a set of IKE_SAs identified by a segment.
-        *
-        * @param segment       numerical segment to takeover, 0 for all
-        * @param notify        wheter to notify other nodes about activation
-        */
-       void (*activate)(ha_segments_t *this, u_int segment, bool notify);
-
-       /**
-        * Deactivate a set of IKE_SAs identified by a segment.
-        *
-        * @param segment       numerical segment to takeover, 0 for all
-        * @param notify        wheter to notify other nodes about deactivation
-        */
-       void (*deactivate)(ha_segments_t *this, u_int segment, bool notify);
-
-       /**
-        * Resync an active segment.
-        *
-        * To reintegrade a node into the cluster, resynchronization is reqired.
-        * IKE_SAs and CHILD_SAs are synced automatically during rekeying. A call
-        * to this method enforces a rekeying immediately sync all state of a
-        * segment.
-        *
-        * @param segment       segment to resync
-        */
-       void (*resync)(ha_segments_t *this, u_int segment);
-
-       /**
-        * Handle a status message from the remote node.
-        *
-        * @param mask          segments the remote node is serving actively
-        */
-       void (*handle_status)(ha_segments_t *this, segment_mask_t mask);
-
-       /**
-        * Destroy a ha_segments_t.
-        */
-       void (*destroy)(ha_segments_t *this);
-};
-
-/**
- * Create a ha_segments instance.
- *
- * @param socket               socket to communicate segment (de-)activation
- * @param kernel               interface to control segments at kernel level
- * @param tunnel               HA tunnel
- * @param count                        number of segments the cluster uses
- * @param node                 node, currently 1 or 0
- * @param monitor              should we use monitoring functionality
- * @param resync               request a complete resync on startup
- * @return                             segment object
- */
-ha_segments_t *ha_segments_create(ha_socket_t *socket, ha_kernel_t *kernel,
-                                                                 ha_tunnel_t *tunnel, u_int count, u_int node,
-                                                                 bool monitor, bool resync);
-
-#endif /* HA_SEGMENTS_ @}*/
diff --git a/src/charon/plugins/ha/ha_socket.c b/src/charon/plugins/ha/ha_socket.c
deleted file mode 100644 (file)
index b84b028..0000000
+++ /dev/null
@@ -1,234 +0,0 @@
-/*
- * Copyright (C) 2008-2009 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ha_socket.h"
-#include "ha_plugin.h"
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <errno.h>
-#include <unistd.h>
-#include <pthread.h>
-
-#include <daemon.h>
-#include <utils/host.h>
-#include <processing/jobs/callback_job.h>
-
-typedef struct private_ha_socket_t private_ha_socket_t;
-
-/**
- * Private data of an ha_socket_t object.
- */
-struct private_ha_socket_t {
-
-       /**
-        * Public ha_socket_t interface.
-        */
-       ha_socket_t public;
-
-       /**
-        * UDP communication socket fd
-        */
-       int fd;
-
-       /**
-        * local host to receive/send from
-        */
-       host_t *local;
-
-       /**
-        * remote host to receive/send to
-        */
-       host_t *remote;
-};
-
-/**
- * Data to pass to the send_message() callback job
- */
-typedef struct {
-       ha_message_t *message;
-       private_ha_socket_t *this;
-} job_data_t;
-
-/**
- * Cleanup job data
- */
-static void job_data_destroy(job_data_t *this)
-{
-       this->message->destroy(this->message);
-       free(this);
-}
-
-/**
- * Callback to asynchronously send messages
- */
-static job_requeue_t send_message(job_data_t *data)
-{
-       private_ha_socket_t *this;
-       chunk_t chunk;
-
-       this = data->this;
-       chunk = data->message->get_encoding(data->message);
-       if (send(this->fd, chunk.ptr, chunk.len, 0) < chunk.len)
-       {
-               DBG1(DBG_CFG, "pushing HA message failed: %s", strerror(errno));
-       }
-       return JOB_REQUEUE_NONE;
-}
-
-/**
- * Implementation of ha_socket_t.push
- */
-static void push(private_ha_socket_t *this, ha_message_t *message)
-{
-       chunk_t chunk;
-
-       /* Try to send synchronously, but non-blocking. */
-       chunk = message->get_encoding(message);
-       if (send(this->fd, chunk.ptr, chunk.len, MSG_DONTWAIT) < chunk.len)
-       {
-               if (errno == EAGAIN)
-               {
-                       callback_job_t *job;
-                       job_data_t *data;
-
-                       /* Fallback to asynchronous transmission. This is required, as sendto()
-                        * is a blocking call if it acquires a policy. We could end up in a
-                        * deadlock, as we own an IKE_SA. */
-                       data = malloc_thing(job_data_t);
-                       data->message = message;
-                       data->this = this;
-
-                       job = callback_job_create((callback_job_cb_t)send_message,
-                                                                         data, (void*)job_data_destroy, NULL);
-                       charon->processor->queue_job(charon->processor, (job_t*)job);
-                       return;
-               }
-               DBG1(DBG_CFG, "pushing HA message failed: %s", strerror(errno));
-       }
-       message->destroy(message);
-}
-
-/**
- * Implementation of ha_socket_t.pull
- */
-static ha_message_t *pull(private_ha_socket_t *this)
-{
-       while (TRUE)
-       {
-               ha_message_t *message;
-               char buf[1024];
-               int oldstate;
-               ssize_t len;
-
-               pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
-               len = recv(this->fd, buf, sizeof(buf), 0);
-               pthread_setcancelstate(oldstate, NULL);
-               if (len <= 0)
-               {
-                       switch (errno)
-                       {
-                               case ECONNREFUSED:
-                               case EINTR:
-                                       continue;
-                               default:
-                                       DBG1(DBG_CFG, "pulling HA message failed: %s",
-                                                strerror(errno));
-                                       sleep(1);
-                       }
-               }
-               message = ha_message_parse(chunk_create(buf, len));
-               if (message)
-               {
-                       return message;
-               }
-       }
-}
-
-/**
- * Open and connect the HA socket
- */
-static bool open_socket(private_ha_socket_t *this)
-{
-       this->fd = socket(this->local->get_family(this->local), SOCK_DGRAM, 0);
-       if (this->fd == -1)
-       {
-               DBG1(DBG_CFG, "opening HA socket failed: %s", strerror(errno));
-               return FALSE;
-       }
-
-       if (bind(this->fd, this->local->get_sockaddr(this->local),
-                        *this->local->get_sockaddr_len(this->local)) == -1)
-       {
-               DBG1(DBG_CFG, "binding HA socket failed: %s", strerror(errno));
-               close(this->fd);
-               this->fd = -1;
-               return FALSE;
-       }
-       if (connect(this->fd, this->remote->get_sockaddr(this->remote),
-                               *this->remote->get_sockaddr_len(this->remote)) == -1)
-       {
-               DBG1(DBG_CFG, "connecting HA socket failed: %s", strerror(errno));
-               close(this->fd);
-               this->fd = -1;
-               return FALSE;
-       }
-
-       return TRUE;
-}
-
-/**
- * Implementation of ha_socket_t.destroy.
- */
-static void destroy(private_ha_socket_t *this)
-{
-       if (this->fd != -1)
-       {
-               close(this->fd);
-       }
-       DESTROY_IF(this->local);
-       DESTROY_IF(this->remote);
-       free(this);
-}
-
-/**
- * See header
- */
-ha_socket_t *ha_socket_create(char *local, char *remote)
-{
-       private_ha_socket_t *this = malloc_thing(private_ha_socket_t);
-
-       this->public.push = (void(*)(ha_socket_t*, ha_message_t*))push;
-       this->public.pull = (ha_message_t*(*)(ha_socket_t*))pull;
-       this->public.destroy = (void(*)(ha_socket_t*))destroy;
-
-       this->local = host_create_from_dns(local, 0, HA_PORT);
-       this->remote = host_create_from_dns(remote, 0, HA_PORT);
-       this->fd = -1;
-
-       if (!this->local || !this->remote)
-       {
-               DBG1(DBG_CFG, "invalid local/remote HA address");
-               destroy(this);
-               return NULL;
-       }
-       if (!open_socket(this))
-       {
-               destroy(this);
-               return NULL;
-       }
-       return &this->public;
-}
-
diff --git a/src/charon/plugins/ha/ha_socket.h b/src/charon/plugins/ha/ha_socket.h
deleted file mode 100644 (file)
index 8d398e2..0000000
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha_socket ha_socket
- * @{ @ingroup ha
- */
-
-#ifndef HA_SOCKET_H_
-#define HA_SOCKET_H_
-
-#include "ha_message.h"
-
-#include <sa/ike_sa.h>
-
-typedef struct ha_socket_t ha_socket_t;
-
-/**
- * Socket to send/received SA synchronization data
- */
-struct ha_socket_t {
-
-       /**
-        * Push synchronization information to the responsible node.
-        *
-        * @param message       message to send, gets destroyed by push()
-        */
-       void (*push)(ha_socket_t *this, ha_message_t *message);
-
-       /**
-        * Pull synchronization information from a peer we are responsible.
-        *
-        * @return                      received message
-        */
-       ha_message_t *(*pull)(ha_socket_t *this);
-
-       /**
-        * Destroy a ha_socket_t.
-        */
-       void (*destroy)(ha_socket_t *this);
-};
-
-/**
- * Create a ha_socket instance.
- */
-ha_socket_t *ha_socket_create(char *local, char *remote);
-
-#endif /* HA_SOCKET_ @}*/
diff --git a/src/charon/plugins/ha/ha_tunnel.c b/src/charon/plugins/ha/ha_tunnel.c
deleted file mode 100644 (file)
index 97a252d..0000000
+++ /dev/null
@@ -1,297 +0,0 @@
-/*
- * Copyright (C) 2009 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ha_tunnel.h"
-#include "ha_plugin.h"
-
-#include <daemon.h>
-#include <utils/identification.h>
-#include <processing/jobs/callback_job.h>
-
-typedef struct private_ha_tunnel_t private_ha_tunnel_t;
-typedef struct ha_backend_t ha_backend_t;
-typedef struct ha_creds_t ha_creds_t;
-
-/**
- * Serves credentials for the HA SA
- */
-struct ha_creds_t {
-
-       /**
-        * Implements credential_set_t
-        */
-       credential_set_t public;
-
-       /**
-        * own identity
-        */
-       identification_t *local;
-
-       /**
-        * peer identity
-        */
-       identification_t *remote;
-
-       /**
-        * Shared key to serve
-        */
-       shared_key_t *key;
-};
-
-/**
- * Serves configurations for the HA SA
- */
-struct ha_backend_t {
-
-       /**
-        * Implements backend_t
-        */
-       backend_t public;
-
-       /**
-        * peer config we serve
-        */
-       peer_cfg_t *cfg;
-};
-
-/**
- * Private data of an ha_tunnel_t object.
- */
-struct private_ha_tunnel_t {
-
-       /**
-        * Public ha_tunnel_t interface.
-        */
-       ha_tunnel_t public;
-
-       /**
-        * Reqid of installed trap
-        */
-       u_int32_t trap;
-
-       /**
-        * backend for HA SA
-        */
-       ha_backend_t backend;
-
-       /**
-        * credential set for HA SA
-        */
-       ha_creds_t creds;
-};
-
-/**
- * Implementation of ha_tunnel_t.is_sa
- */
-static bool is_sa(private_ha_tunnel_t *this, ike_sa_t *ike_sa)
-{
-       peer_cfg_t *cfg = this->backend.cfg;
-
-       return cfg && ike_sa->get_ike_cfg(ike_sa) == cfg->get_ike_cfg(cfg);
-}
-
-/**
- * Enumerator over HA shared_key
- */
-typedef struct {
-       /** Implements enumerator_t */
-       enumerator_t public;
-       /** a single secret we serve */
-       shared_key_t *key;
-} shared_enum_t;
-
-/**
- * Implementation of shared_enum_t.enumerate
- */
-static bool shared_enumerate(shared_enum_t *this, shared_key_t **key,
-                                                        id_match_t *me, id_match_t *other)
-{
-       if (this->key)
-       {
-               if (me)
-               {
-                       *me = ID_MATCH_PERFECT;
-               }
-               if (other)
-               {
-                       *other = ID_MATCH_PERFECT;
-               }
-               *key = this->key;
-               this->key = NULL;
-               return TRUE;
-       }
-       return FALSE;
-}
-
-/**
- * Implements ha_creds_t.create_shared_enumerator
- */
-static enumerator_t* create_shared_enumerator(ha_creds_t *this,
-                                                       shared_key_type_t type, identification_t *me,
-                                                       identification_t *other)
-{
-       shared_enum_t *enumerator;
-
-       if (type != SHARED_IKE && type != SHARED_ANY)
-       {
-               return NULL;
-       }
-       if (me && !me->equals(me, this->local))
-       {
-               return NULL;
-       }
-       if (other && !other->equals(other, this->remote))
-       {
-               return NULL;
-       }
-
-       enumerator = malloc_thing(shared_enum_t);
-       enumerator->public.enumerate = (void*)shared_enumerate;
-       enumerator->public.destroy = (void*)free;
-       enumerator->key = this->key;
-
-       return &enumerator->public;
-}
-
-/**
- * Implementation of backend_t.create_peer_cfg_enumerator.
- */
-static enumerator_t* create_peer_cfg_enumerator(ha_backend_t *this,
-                                                               identification_t *me, identification_t *other)
-{
-       return enumerator_create_single(this->cfg, NULL);
-}
-
-/**
- * Implementation of backend_t.create_ike_cfg_enumerator.
- */
-static enumerator_t* create_ike_cfg_enumerator(ha_backend_t *this,
-                                                                                          host_t *me, host_t *other)
-{
-       return enumerator_create_single(this->cfg->get_ike_cfg(this->cfg), NULL);
-}
-
-/**
- * Install configs and a a trap for secured HA message exchange
- */
-static void setup_tunnel(private_ha_tunnel_t *this,
-                                                char *local, char *remote, char *secret)
-{
-       peer_cfg_t *peer_cfg;
-       ike_cfg_t *ike_cfg;
-       auth_cfg_t *auth_cfg;
-       child_cfg_t *child_cfg;
-       traffic_selector_t *ts;
-       lifetime_cfg_t lifetime = {
-               .time = {
-                       .life = 21600, .rekey = 20400, .jitter = 400,
-               },
-       };
-
-       /* setup credentials */
-       this->creds.local = identification_create_from_string(local);
-       this->creds.remote = identification_create_from_string(remote);
-       this->creds.key = shared_key_create(SHARED_IKE,
-                                                       chunk_clone(chunk_create(secret, strlen(secret))));
-       this->creds.public.create_private_enumerator = (void*)return_null;
-       this->creds.public.create_cert_enumerator = (void*)return_null;
-       this->creds.public.create_shared_enumerator = (void*)create_shared_enumerator;
-       this->creds.public.create_cdp_enumerator = (void*)return_null;
-       this->creds.public.cache_cert = (void*)nop;
-
-       charon->credentials->add_set(charon->credentials, &this->creds.public);
-
-       /* create config and backend */
-       ike_cfg = ike_cfg_create(FALSE, FALSE, local, remote);
-       ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
-       peer_cfg = peer_cfg_create("ha", 2, ike_cfg, CERT_NEVER_SEND,
-                                               UNIQUE_KEEP, 0, 86400, 0, 7200, 3600, FALSE, 30,
-                                               NULL, NULL, FALSE, NULL, NULL);
-
-       auth_cfg = auth_cfg_create();
-       auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
-       auth_cfg->add(auth_cfg, AUTH_RULE_IDENTITY,
-                                 identification_create_from_string(local));
-       peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, TRUE);
-
-       auth_cfg = auth_cfg_create();
-       auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
-       auth_cfg->add(auth_cfg, AUTH_RULE_IDENTITY,
-                                 identification_create_from_string(remote));
-       peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, FALSE);
-
-       child_cfg = child_cfg_create("ha", &lifetime, NULL, TRUE,
-                                               MODE_TRANSPORT, ACTION_NONE, ACTION_NONE, FALSE);
-       ts = traffic_selector_create_dynamic(IPPROTO_UDP, HA_PORT, HA_PORT);
-       child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
-       ts = traffic_selector_create_dynamic(IPPROTO_ICMP, 0, 65535);
-       child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
-       ts = traffic_selector_create_dynamic(IPPROTO_UDP, HA_PORT, HA_PORT);
-       child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
-       ts = traffic_selector_create_dynamic(IPPROTO_ICMP, 0, 65535);
-       child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
-       child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
-       peer_cfg->add_child_cfg(peer_cfg, child_cfg);
-
-       this->backend.cfg = peer_cfg;
-       this->backend.public.create_peer_cfg_enumerator = (void*)create_peer_cfg_enumerator;
-       this->backend.public.create_ike_cfg_enumerator = (void*)create_ike_cfg_enumerator;
-       this->backend.public.get_peer_cfg_by_name = (void*)return_null;
-
-       charon->backends->add_backend(charon->backends, &this->backend.public);
-
-       /* install an acquiring trap */
-       this->trap = charon->traps->install(charon->traps, peer_cfg, child_cfg);
-}
-
-/**
- * Implementation of ha_tunnel_t.destroy.
- */
-static void destroy(private_ha_tunnel_t *this)
-{
-       if (this->backend.cfg)
-       {
-               charon->backends->remove_backend(charon->backends, &this->backend.public);
-               this->backend.cfg->destroy(this->backend.cfg);
-       }
-       if (this->creds.key)
-       {
-               charon->credentials->remove_set(charon->credentials, &this->creds.public);
-               this->creds.key->destroy(this->creds.key);
-       }
-       this->creds.local->destroy(this->creds.local);
-       this->creds.remote->destroy(this->creds.remote);
-       if (this->trap)
-       {
-               charon->traps->uninstall(charon->traps, this->trap);
-       }
-       free(this);
-}
-
-/**
- * See header
- */
-ha_tunnel_t *ha_tunnel_create(char *local, char *remote, char *secret)
-{
-       private_ha_tunnel_t *this = malloc_thing(private_ha_tunnel_t);
-
-       this->public.is_sa = (bool(*)(ha_tunnel_t*, ike_sa_t *ike_sa))is_sa;
-       this->public.destroy = (void(*)(ha_tunnel_t*))destroy;
-
-       setup_tunnel(this, local, remote, secret);
-
-       return &this->public;
-}
-
diff --git a/src/charon/plugins/ha/ha_tunnel.h b/src/charon/plugins/ha/ha_tunnel.h
deleted file mode 100644 (file)
index 085fb61..0000000
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2009 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ha_ ha_tunnel
- * @{ @ingroup ha
- */
-
-#ifndef HA_TUNNEL_H_
-#define HA_TUNNEL_H_
-
-#include <sa/ike_sa.h>
-
-typedef struct ha_tunnel_t ha_tunnel_t;
-
-/**
- * Socket to send/received SA synchronization data
- */
-struct ha_tunnel_t {
-
-       /**
-        * Check if an IKE_SA is used for exchanging HA messages.
-        *
-        * @param ike_Sa        ike_sa to check
-        * @return                      TRUE if IKE_SA is used to secure HA messages
-        */
-       bool (*is_sa)(ha_tunnel_t *this, ike_sa_t *ike_sa);
-
-       /**
-        * Destroy a ha_tunnel_t.
-        */
-       void (*destroy)(ha_tunnel_t *this);
-};
-
-/**
- * Create a ha_tunnel instance.
- *
- * @param local                local address of HA tunnel
- * @param remote       remote address of HA tunnel
- * @param secret       PSK tunnel authentication secret
- * @return                     HA tunnel instance
- */
-ha_tunnel_t *ha_tunnel_create(char *local, char *remote, char *secret);
-
-#endif /* HA_TUNNEL_H_ @}*/
index 14d3c39..df056ad 100644 (file)
@@ -388,6 +388,14 @@ if MONOLITHIC
 endif
 endif
 
+if USE_HA
+  SUBDIRS += plugins/ha
+  PLUGINS += ha
+if MONOLITHIC
+  libcharon_la_LIBADD += plugins/ha/libstrongswan-ha.la
+endif
+endif
+
 if USE_UCI
   SUBDIRS += plugins/uci
   PLUGINS += uci
diff --git a/src/libcharon/plugins/ha/Makefile.am b/src/libcharon/plugins/ha/Makefile.am
new file mode 100644 (file)
index 0000000..9d321dc
--- /dev/null
@@ -0,0 +1,24 @@
+
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libcharon
+
+AM_CFLAGS = -rdynamic -DIPSEC_PIDDIR=\"${piddir}\"
+
+if MONOLITHIC
+noinst_LTLIBRARIES = libstrongswan-ha.la
+else
+plugin_LTLIBRARIES = libstrongswan-ha.la
+endif
+
+libstrongswan_ha_la_SOURCES = \
+  ha_plugin.h ha_plugin.c \
+  ha_message.h ha_message.c \
+  ha_socket.h ha_socket.c \
+  ha_tunnel.h ha_tunnel.c \
+  ha_dispatcher.h ha_dispatcher.c \
+  ha_segments.h ha_segments.c \
+  ha_kernel.h ha_kernel.c \
+  ha_ctl.h ha_ctl.c \
+  ha_ike.h ha_ike.c \
+  ha_child.h ha_child.c
+libstrongswan_ha_la_LDFLAGS = -module -avoid-version
+
diff --git a/src/libcharon/plugins/ha/ha_child.c b/src/libcharon/plugins/ha/ha_child.c
new file mode 100644 (file)
index 0000000..2eb8e27
--- /dev/null
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ha_child.h"
+
+typedef struct private_ha_child_t private_ha_child_t;
+
+/**
+ * Private data of an ha_child_t object.
+ */
+struct private_ha_child_t {
+
+       /**
+        * Public ha_child_t interface.
+        */
+       ha_child_t public;
+
+       /**
+        * socket we use for syncing
+        */
+       ha_socket_t *socket;
+
+       /**
+        * tunnel securing sync messages
+        */
+       ha_tunnel_t *tunnel;
+};
+
+/**
+ * Implementation of listener_t.child_keys
+ */
+static bool child_keys(private_ha_child_t *this, ike_sa_t *ike_sa,
+                                          child_sa_t *child_sa, diffie_hellman_t *dh,
+                                          chunk_t nonce_i, chunk_t nonce_r)
+{
+       ha_message_t *m;
+       chunk_t secret;
+       proposal_t *proposal;
+       u_int16_t alg, len;
+       linked_list_t *list;
+       enumerator_t *enumerator;
+       traffic_selector_t *ts;
+
+       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
+       {       /* do not sync SA between nodes */
+               return TRUE;
+       }
+
+       m = ha_message_create(HA_CHILD_ADD);
+
+       m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
+       m->add_attribute(m, HA_INBOUND_SPI, child_sa->get_spi(child_sa, TRUE));
+       m->add_attribute(m, HA_OUTBOUND_SPI, child_sa->get_spi(child_sa, FALSE));
+       m->add_attribute(m, HA_INBOUND_CPI, child_sa->get_cpi(child_sa, TRUE));
+       m->add_attribute(m, HA_OUTBOUND_CPI, child_sa->get_cpi(child_sa, FALSE));
+       m->add_attribute(m, HA_IPSEC_MODE, child_sa->get_mode(child_sa));
+       m->add_attribute(m, HA_IPCOMP, child_sa->get_ipcomp(child_sa));
+       m->add_attribute(m, HA_CONFIG_NAME, child_sa->get_name(child_sa));
+
+       proposal = child_sa->get_proposal(child_sa);
+       if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &len))
+       {
+               m->add_attribute(m, HA_ALG_ENCR, alg);
+               if (len)
+               {
+                       m->add_attribute(m, HA_ALG_ENCR_LEN, len);
+               }
+       }
+       if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
+       {
+               m->add_attribute(m, HA_ALG_INTEG, alg);
+       }
+       m->add_attribute(m, HA_NONCE_I, nonce_i);
+       m->add_attribute(m, HA_NONCE_R, nonce_r);
+       if (dh && dh->get_shared_secret(dh, &secret) == SUCCESS)
+       {
+               m->add_attribute(m, HA_SECRET, secret);
+               chunk_clear(&secret);
+       }
+
+       list = child_sa->get_traffic_selectors(child_sa, TRUE);
+       enumerator = list->create_enumerator(list);
+       while (enumerator->enumerate(enumerator, &ts))
+       {
+               m->add_attribute(m, HA_LOCAL_TS, ts);
+       }
+       enumerator->destroy(enumerator);
+       list = child_sa->get_traffic_selectors(child_sa, FALSE);
+       enumerator = list->create_enumerator(list);
+       while (enumerator->enumerate(enumerator, &ts))
+       {
+               m->add_attribute(m, HA_REMOTE_TS, ts);
+       }
+       enumerator->destroy(enumerator);
+
+       this->socket->push(this->socket, m);
+
+       return TRUE;
+}
+
+/**
+ * Implementation of listener_t.child_state_change
+ */
+static bool child_state_change(private_ha_child_t *this, ike_sa_t *ike_sa,
+                                                          child_sa_t *child_sa, child_sa_state_t state)
+{
+       if (!ike_sa ||
+               ike_sa->get_state(ike_sa) == IKE_PASSIVE ||
+               ike_sa->get_state(ike_sa) == IKE_DESTROYING)
+       {       /* only sync active IKE_SAs */
+               return TRUE;
+       }
+       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
+       {       /* do not sync SA between nodes */
+               return TRUE;
+       }
+
+
+       if (state == CHILD_DESTROYING)
+       {
+               ha_message_t *m;
+
+               m = ha_message_create(HA_CHILD_DELETE);
+
+               m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
+               m->add_attribute(m, HA_INBOUND_SPI,
+                                                child_sa->get_spi(child_sa, TRUE));
+               this->socket->push(this->socket, m);
+       }
+       return TRUE;
+}
+
+/**
+ * Implementation of ha_child_t.destroy.
+ */
+static void destroy(private_ha_child_t *this)
+{
+       free(this);
+}
+
+/**
+ * See header
+ */
+ha_child_t *ha_child_create(ha_socket_t *socket, ha_tunnel_t *tunnel)
+{
+       private_ha_child_t *this = malloc_thing(private_ha_child_t);
+
+       memset(&this->public.listener, 0, sizeof(listener_t));
+       this->public.listener.child_keys = (bool(*)(listener_t*, ike_sa_t *ike_sa, child_sa_t *child_sa, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r))child_keys;
+       this->public.listener.child_state_change = (bool(*)(listener_t*,ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state))child_state_change;
+       this->public.destroy = (void(*)(ha_child_t*))destroy;
+
+       this->socket = socket;
+       this->tunnel = tunnel;
+
+       return &this->public;
+}
+
diff --git a/src/libcharon/plugins/ha/ha_child.h b/src/libcharon/plugins/ha/ha_child.h
new file mode 100644 (file)
index 0000000..ea83495
--- /dev/null
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ha_child ha_child
+ * @{ @ingroup ha
+ */
+
+#ifndef HA_CHILD_H_
+#define HA_CHILD_H_
+
+#include "ha_socket.h"
+#include "ha_tunnel.h"
+#include "ha_segments.h"
+
+#include <daemon.h>
+
+typedef struct ha_child_t ha_child_t;
+
+/**
+ * Listener to synchronize CHILD_SAs.
+ */
+struct ha_child_t {
+
+       /**
+        * Implements bus listener interface.
+        */
+       listener_t listener;
+
+       /**
+        * Destroy a ha_child_t.
+        */
+       void (*destroy)(ha_child_t *this);
+};
+
+/**
+ * Create a ha_child instance.
+ *
+ * @param socket               socket to use for sending synchronization messages
+ * @param tunnel               tunnel securing sync messages, if any
+ * @return                             CHILD listener
+ */
+ha_child_t *ha_child_create(ha_socket_t *socket, ha_tunnel_t *tunnel);
+
+#endif /* HA_CHILD_ @}*/
diff --git a/src/libcharon/plugins/ha/ha_ctl.c b/src/libcharon/plugins/ha/ha_ctl.c
new file mode 100644 (file)
index 0000000..441d26d
--- /dev/null
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ha_ctl.h"
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/select.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <errno.h>
+#include <pthread.h>
+
+#include <processing/jobs/callback_job.h>
+
+#define HA_FIFO IPSEC_PIDDIR "/charon.ha"
+
+typedef struct private_ha_ctl_t private_ha_ctl_t;
+
+/**
+ * Private data of an ha_ctl_t object.
+ */
+struct private_ha_ctl_t {
+
+       /**
+        * Public ha_ctl_t interface.
+        */
+       ha_ctl_t public;
+
+       /**
+        * Segments to control
+        */
+       ha_segments_t *segments;
+
+       /**
+        * FIFO reader thread
+        */
+       callback_job_t *job;
+};
+
+/**
+ * FIFO dispatching function
+ */
+static job_requeue_t dispatch_fifo(private_ha_ctl_t *this)
+{
+       int fifo, old;
+       char buf[8];
+       u_int segment;
+
+       pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &old);
+       fifo = open(HA_FIFO, O_RDONLY);
+       pthread_setcancelstate(old, NULL);
+       if (fifo == -1)
+       {
+               DBG1(DBG_CFG, "opening HA fifo failed: %s", strerror(errno));
+               sleep(1);
+               return JOB_REQUEUE_FAIR;
+       }
+
+       memset(buf, 0, sizeof(buf));
+       if (read(fifo, buf, sizeof(buf)-1) > 1)
+       {
+               segment = atoi(&buf[1]);
+               if (segment)
+               {
+                       switch (buf[0])
+                       {
+                               case '+':
+                                       this->segments->activate(this->segments, segment, TRUE);
+                                       break;
+                               case '-':
+                                       this->segments->deactivate(this->segments, segment, TRUE);
+                                       break;
+                               case '*':
+                                       this->segments->resync(this->segments, segment);
+                                       break;
+                               default:
+                                       break;
+                       }
+               }
+       }
+       close(fifo);
+
+       return JOB_REQUEUE_DIRECT;
+}
+
+/**
+ * Implementation of ha_ctl_t.destroy.
+ */
+static void destroy(private_ha_ctl_t *this)
+{
+       this->job->cancel(this->job);
+       free(this);
+}
+
+/**
+ * See header
+ */
+ha_ctl_t *ha_ctl_create(ha_segments_t *segments)
+{
+       private_ha_ctl_t *this = malloc_thing(private_ha_ctl_t);
+
+       this->public.destroy = (void(*)(ha_ctl_t*))destroy;
+
+       if (access(HA_FIFO, R_OK|W_OK) != 0)
+       {
+               if (mkfifo(HA_FIFO, 600) != 0)
+               {
+                       DBG1(DBG_CFG, "creating HA FIFO %s failed: %s",
+                                HA_FIFO, strerror(errno));
+               }
+       }
+
+       this->segments = segments;
+       this->job = callback_job_create((callback_job_cb_t)dispatch_fifo,
+                                                                       this, NULL, NULL);
+       charon->processor->queue_job(charon->processor, (job_t*)this->job);
+       return &this->public;
+}
+
diff --git a/src/libcharon/plugins/ha/ha_ctl.h b/src/libcharon/plugins/ha/ha_ctl.h
new file mode 100644 (file)
index 0000000..f33a809
--- /dev/null
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ha_ctl ha_ctl
+ * @{ @ingroup ha
+ */
+
+#ifndef HA_CTL_H_
+#define HA_CTL_H_
+
+#include "ha_segments.h"
+
+typedef struct ha_ctl_t ha_ctl_t;
+
+/**
+ * HA Sync control interface using a FIFO.
+ */
+struct ha_ctl_t {
+
+       /**
+        * Destroy a ha_ctl_t.
+        */
+       void (*destroy)(ha_ctl_t *this);
+};
+
+/**
+ * Create a ha_ctl instance.
+ *
+ * @param segments     segments to control
+ * @return                     HA control interface
+ */
+ha_ctl_t *ha_ctl_create(ha_segments_t *segments);
+
+#endif /* HA_CTL_ @}*/
diff --git a/src/libcharon/plugins/ha/ha_dispatcher.c b/src/libcharon/plugins/ha/ha_dispatcher.c
new file mode 100644 (file)
index 0000000..4acf747
--- /dev/null
@@ -0,0 +1,737 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ha_dispatcher.h"
+
+#include <daemon.h>
+#include <processing/jobs/callback_job.h>
+
+typedef struct private_ha_dispatcher_t private_ha_dispatcher_t;
+
+/**
+ * Private data of an ha_dispatcher_t object.
+ */
+struct private_ha_dispatcher_t {
+
+       /**
+        * Public ha_dispatcher_t interface.
+        */
+       ha_dispatcher_t public;
+
+       /**
+        * socket to pull messages from
+        */
+       ha_socket_t *socket;
+
+       /**
+        * segments to control
+        */
+       ha_segments_t *segments;
+
+       /**
+        * Dispatcher job
+        */
+       callback_job_t *job;
+};
+
+/**
+ * Quick and dirty hack implementation of diffie_hellman_t.get_shared_secret
+ */
+static status_t get_shared_secret(diffie_hellman_t *this, chunk_t *secret)
+{
+       *secret = chunk_clone((*(chunk_t*)this->destroy));
+       return SUCCESS;
+}
+
+/**
+ * Process messages of type IKE_ADD
+ */
+static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message)
+{
+       ha_message_attribute_t attribute;
+       ha_message_value_t value;
+       enumerator_t *enumerator;
+       ike_sa_t *ike_sa = NULL, *old_sa = NULL;
+       u_int16_t encr = 0, len = 0, integ = 0, prf = 0, old_prf = PRF_UNDEFINED;
+       chunk_t nonce_i = chunk_empty, nonce_r = chunk_empty;
+       chunk_t secret = chunk_empty, old_skd = chunk_empty;
+
+       enumerator = message->create_attribute_enumerator(message);
+       while (enumerator->enumerate(enumerator, &attribute, &value))
+       {
+               switch (attribute)
+               {
+                       case HA_IKE_ID:
+                               ike_sa = ike_sa_create(value.ike_sa_id);
+                               break;
+                       case HA_IKE_REKEY_ID:
+                               old_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
+                                                                                                                 value.ike_sa_id);
+                               break;
+                       case HA_NONCE_I:
+                               nonce_i = value.chunk;
+                               break;
+                       case HA_NONCE_R:
+                               nonce_r = value.chunk;
+                               break;
+                       case HA_SECRET:
+                               secret = value.chunk;
+                               break;
+                       case HA_OLD_SKD:
+                               old_skd = value.chunk;
+                               break;
+                       case HA_ALG_ENCR:
+                               encr = value.u16;
+                               break;
+                       case HA_ALG_ENCR_LEN:
+                               len = value.u16;
+                               break;
+                       case HA_ALG_INTEG:
+                               integ = value.u16;
+                               break;
+                       case HA_ALG_PRF:
+                               prf = value.u16;
+                               break;
+                       case HA_ALG_OLD_PRF:
+                               old_prf = value.u16;
+                               break;
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+
+       if (ike_sa)
+       {
+               proposal_t *proposal;
+               keymat_t *keymat;
+               /* quick and dirty hack of a DH implementation ;-) */
+               diffie_hellman_t dh = { .get_shared_secret = get_shared_secret,
+                                                               .destroy = (void*)&secret };
+
+               proposal = proposal_create(PROTO_IKE);
+               keymat = ike_sa->get_keymat(ike_sa);
+               if (integ)
+               {
+                       proposal->add_algorithm(proposal, INTEGRITY_ALGORITHM, integ, 0);
+               }
+               if (encr)
+               {
+                       proposal->add_algorithm(proposal, ENCRYPTION_ALGORITHM, encr, len);
+               }
+               if (prf)
+               {
+                       proposal->add_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, prf, 0);
+               }
+               charon->bus->set_sa(charon->bus, ike_sa);
+               if (keymat->derive_ike_keys(keymat, proposal, &dh, nonce_i, nonce_r,
+                                                                        ike_sa->get_id(ike_sa), old_prf, old_skd))
+               {
+                       if (old_sa)
+                       {
+                               peer_cfg_t *peer_cfg = old_sa->get_peer_cfg(old_sa);
+
+                               if (peer_cfg)
+                               {
+                                       ike_sa->set_peer_cfg(ike_sa, peer_cfg);
+                                       ike_sa->inherit(ike_sa, old_sa);
+                               }
+                               charon->ike_sa_manager->checkin_and_destroy(
+                                                                                               charon->ike_sa_manager, old_sa);
+                               old_sa = NULL;
+                       }
+                       ike_sa->set_state(ike_sa, IKE_CONNECTING);
+                       charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+               }
+               else
+               {
+                       DBG1(DBG_IKE, "HA keymat derivation failed");
+                       ike_sa->destroy(ike_sa);
+               }
+               charon->bus->set_sa(charon->bus, NULL);
+               proposal->destroy(proposal);
+       }
+       if (old_sa)
+       {
+               charon->ike_sa_manager->checkin(charon->ike_sa_manager, old_sa);
+       }
+}
+
+/**
+ * Apply a condition flag to the IKE_SA if it is in set
+ */
+static void set_condition(ike_sa_t *ike_sa, ike_condition_t set,
+                                                 ike_condition_t flag)
+{
+       ike_sa->set_condition(ike_sa, flag, flag & set);
+}
+
+/**
+ * Apply a extension flag to the IKE_SA if it is in set
+ */
+static void set_extension(ike_sa_t *ike_sa, ike_extension_t set,
+                                                 ike_extension_t flag)
+{
+       if (flag & set)
+       {
+               ike_sa->enable_extension(ike_sa, flag);
+       }
+}
+
+/**
+ * Process messages of type IKE_UPDATE
+ */
+static void process_ike_update(private_ha_dispatcher_t *this,
+                                                          ha_message_t *message)
+{
+       ha_message_attribute_t attribute;
+       ha_message_value_t value;
+       enumerator_t *enumerator;
+       ike_sa_t *ike_sa = NULL;
+       peer_cfg_t *peer_cfg = NULL;
+
+       enumerator = message->create_attribute_enumerator(message);
+       while (enumerator->enumerate(enumerator, &attribute, &value))
+       {
+               if (attribute != HA_IKE_ID && ike_sa == NULL)
+               {
+                       /* must be first attribute */
+                       break;
+               }
+               switch (attribute)
+               {
+                       case HA_IKE_ID:
+                               ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
+                                                                                                                 value.ike_sa_id);
+                               break;
+                       case HA_LOCAL_ID:
+                               ike_sa->set_my_id(ike_sa, value.id->clone(value.id));
+                               break;
+                       case HA_REMOTE_ID:
+                               ike_sa->set_other_id(ike_sa, value.id->clone(value.id));
+                               break;
+                       case HA_EAP_ID:
+                               ike_sa->set_eap_identity(ike_sa, value.id->clone(value.id));
+                               break;
+                       case HA_LOCAL_ADDR:
+                               ike_sa->set_my_host(ike_sa, value.host->clone(value.host));
+                               break;
+                       case HA_REMOTE_ADDR:
+                               ike_sa->set_other_host(ike_sa, value.host->clone(value.host));
+                               break;
+                       case HA_LOCAL_VIP:
+                               ike_sa->set_virtual_ip(ike_sa, TRUE, value.host);
+                               break;
+                       case HA_REMOTE_VIP:
+                               ike_sa->set_virtual_ip(ike_sa, FALSE, value.host);
+                               break;
+                       case HA_ADDITIONAL_ADDR:
+                               ike_sa->add_additional_address(ike_sa,
+                                                                                          value.host->clone(value.host));
+                               break;
+                       case HA_CONFIG_NAME:
+                               peer_cfg = charon->backends->get_peer_cfg_by_name(
+                                                                                               charon->backends, value.str);
+                               if (peer_cfg)
+                               {
+                                       ike_sa->set_peer_cfg(ike_sa, peer_cfg);
+                                       peer_cfg->destroy(peer_cfg);
+                               }
+                               else
+                               {
+                                       DBG1(DBG_IKE, "HA is missing nodes peer configuration");
+                               }
+                               break;
+                       case HA_EXTENSIONS:
+                               set_extension(ike_sa, value.u32, EXT_NATT);
+                               set_extension(ike_sa, value.u32, EXT_MOBIKE);
+                               set_extension(ike_sa, value.u32, EXT_HASH_AND_URL);
+                               break;
+                       case HA_CONDITIONS:
+                               set_condition(ike_sa, value.u32, COND_NAT_ANY);
+                               set_condition(ike_sa, value.u32, COND_NAT_HERE);
+                               set_condition(ike_sa, value.u32, COND_NAT_THERE);
+                               set_condition(ike_sa, value.u32, COND_NAT_FAKE);
+                               set_condition(ike_sa, value.u32, COND_EAP_AUTHENTICATED);
+                               set_condition(ike_sa, value.u32, COND_CERTREQ_SEEN);
+                               set_condition(ike_sa, value.u32, COND_ORIGINAL_INITIATOR);
+                               break;
+                       case HA_INITIATE_MID:
+                               ike_sa->set_message_id(ike_sa, TRUE, value.u32);
+                               break;
+                       case HA_RESPOND_MID:
+                               ike_sa->set_message_id(ike_sa, FALSE, value.u32);
+                               break;
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+
+       if (ike_sa)
+       {
+               if (ike_sa->get_state(ike_sa) == IKE_CONNECTING &&
+                       ike_sa->get_peer_cfg(ike_sa))
+               {
+                       ike_sa->set_state(ike_sa, IKE_PASSIVE);
+               }
+               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+       }
+}
+
+/**
+ * Process messages of type IKE_DELETE
+ */
+static void process_ike_delete(private_ha_dispatcher_t *this,
+                                                          ha_message_t *message)
+{
+       ha_message_attribute_t attribute;
+       ha_message_value_t value;
+       enumerator_t *enumerator;
+       ike_sa_t *ike_sa;
+
+       enumerator = message->create_attribute_enumerator(message);
+       while (enumerator->enumerate(enumerator, &attribute, &value))
+       {
+               switch (attribute)
+               {
+                       case HA_IKE_ID:
+                               ike_sa = charon->ike_sa_manager->checkout(
+                                                                       charon->ike_sa_manager, value.ike_sa_id);
+                               if (ike_sa)
+                               {
+                                       charon->ike_sa_manager->checkin_and_destroy(
+                                                                       charon->ike_sa_manager, ike_sa);
+                               }
+                               break;
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Lookup a child cfg from the peer cfg by name
+ */
+static child_cfg_t* find_child_cfg(ike_sa_t *ike_sa, char *name)
+{
+       peer_cfg_t *peer_cfg;
+       child_cfg_t *current, *found = NULL;
+       enumerator_t *enumerator;
+
+       peer_cfg = ike_sa->get_peer_cfg(ike_sa);
+       if (peer_cfg)
+       {
+               enumerator = peer_cfg->create_child_cfg_enumerator(peer_cfg);
+               while (enumerator->enumerate(enumerator, &current))
+               {
+                       if (streq(current->get_name(current), name))
+                       {
+                               found = current;
+                               break;
+                       }
+               }
+               enumerator->destroy(enumerator);
+       }
+       return found;
+}
+
+/**
+ * Process messages of type CHILD_ADD
+ */
+static void process_child_add(private_ha_dispatcher_t *this,
+                                                         ha_message_t *message)
+{
+       ha_message_attribute_t attribute;
+       ha_message_value_t value;
+       enumerator_t *enumerator;
+       ike_sa_t *ike_sa = NULL;
+       char *config_name;
+       child_cfg_t *config = NULL;
+       child_sa_t *child_sa;
+       proposal_t *proposal;
+       keymat_t *keymat;
+       bool initiator, failed = FALSE;
+       u_int32_t inbound_spi = 0, outbound_spi = 0;
+       u_int16_t inbound_cpi = 0, outbound_cpi = 0;
+       u_int8_t mode = MODE_TUNNEL, ipcomp = 0;
+       u_int16_t encr = ENCR_UNDEFINED, integ = AUTH_UNDEFINED, len = 0;
+       chunk_t nonce_i = chunk_empty, nonce_r = chunk_empty, secret = chunk_empty;
+       chunk_t encr_i, integ_i, encr_r, integ_r;
+       linked_list_t *local_ts, *remote_ts;
+       /* quick and dirty hack of a DH implementation */
+       diffie_hellman_t dh = { .get_shared_secret = get_shared_secret,
+                                                       .destroy = (void*)&secret };
+
+       enumerator = message->create_attribute_enumerator(message);
+       while (enumerator->enumerate(enumerator, &attribute, &value))
+       {
+               switch (attribute)
+               {
+                       case HA_IKE_ID:
+                               ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
+                                                                                                                 value.ike_sa_id);
+                               initiator = value.ike_sa_id->is_initiator(value.ike_sa_id);
+                               break;
+                       case HA_CONFIG_NAME:
+                               config_name = value.str;
+                               break;
+                       case HA_INBOUND_SPI:
+                               inbound_spi = value.u32;
+                               break;
+                       case HA_OUTBOUND_SPI:
+                               outbound_spi = value.u32;
+                               break;
+                       case HA_INBOUND_CPI:
+                               inbound_cpi = value.u32;
+                               break;
+                       case HA_OUTBOUND_CPI:
+                               outbound_cpi = value.u32;
+                               break;
+                       case HA_IPSEC_MODE:
+                               mode = value.u8;
+                               break;
+                       case HA_IPCOMP:
+                               ipcomp = value.u8;
+                               break;
+                       case HA_ALG_ENCR:
+                               encr = value.u16;
+                               break;
+                       case HA_ALG_ENCR_LEN:
+                               len = value.u16;
+                               break;
+                       case HA_ALG_INTEG:
+                               integ = value.u16;
+                               break;
+                       case HA_NONCE_I:
+                               nonce_i = value.chunk;
+                               break;
+                       case HA_NONCE_R:
+                               nonce_r = value.chunk;
+                               break;
+                       case HA_SECRET:
+                               secret = value.chunk;
+                               break;
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+
+       if (!ike_sa)
+       {
+               DBG1(DBG_CHD, "IKE_SA for HA CHILD_SA not found");
+               return;
+       }
+       config = find_child_cfg(ike_sa, config_name);
+       if (!config)
+       {
+               DBG1(DBG_CHD, "HA is missing nodes child configuration");
+               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+               return;
+       }
+
+       child_sa = child_sa_create(ike_sa->get_my_host(ike_sa),
+                                                          ike_sa->get_other_host(ike_sa), config, 0,
+                                                          ike_sa->has_condition(ike_sa, COND_NAT_ANY));
+       child_sa->set_mode(child_sa, mode);
+       child_sa->set_protocol(child_sa, PROTO_ESP);
+       child_sa->set_ipcomp(child_sa, ipcomp);
+
+       proposal = proposal_create(PROTO_ESP);
+       if (integ)
+       {
+               proposal->add_algorithm(proposal, INTEGRITY_ALGORITHM, integ, 0);
+       }
+       if (encr)
+       {
+               proposal->add_algorithm(proposal, ENCRYPTION_ALGORITHM, encr, len);
+       }
+       keymat = ike_sa->get_keymat(ike_sa);
+
+       if (!keymat->derive_child_keys(keymat, proposal, secret.ptr ? &dh : NULL,
+                                       nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
+       {
+               DBG1(DBG_CHD, "HA CHILD_SA key derivation failed");
+               child_sa->destroy(child_sa);
+               proposal->destroy(proposal);
+               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+               return;
+       }
+       child_sa->set_proposal(child_sa, proposal);
+       child_sa->set_state(child_sa, CHILD_INSTALLING);
+       proposal->destroy(proposal);
+
+       if (initiator)
+       {
+               if (child_sa->install(child_sa, encr_r, integ_r,
+                                                         inbound_spi, inbound_cpi, TRUE) != SUCCESS ||
+                       child_sa->install(child_sa, encr_i, integ_i,
+                                                         outbound_spi, outbound_cpi, FALSE) != SUCCESS)
+               {
+                       failed = TRUE;
+               }
+       }
+       else
+       {
+               if (child_sa->install(child_sa, encr_i, integ_i,
+                                                         inbound_spi, inbound_cpi, TRUE) != SUCCESS ||
+                       child_sa->install(child_sa, encr_r, integ_r,
+                                                         outbound_spi, outbound_cpi, FALSE) != SUCCESS)
+               {
+                       failed = TRUE;
+               }
+       }
+       chunk_clear(&encr_i);
+       chunk_clear(&integ_i);
+       chunk_clear(&encr_r);
+       chunk_clear(&integ_r);
+
+       if (failed)
+       {
+               DBG1(DBG_CHD, "HA CHILD_SA installation failed");
+               child_sa->destroy(child_sa);
+               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+               return;
+       }
+
+       /* TODO: Change CHILD_SA API to avoid cloning twice */
+       local_ts = linked_list_create();
+       remote_ts = linked_list_create();
+       enumerator = message->create_attribute_enumerator(message);
+       while (enumerator->enumerate(enumerator, &attribute, &value))
+       {
+               switch (attribute)
+               {
+                       case HA_LOCAL_TS:
+                               local_ts->insert_last(local_ts, value.ts->clone(value.ts));
+                               break;
+                       case HA_REMOTE_TS:
+                               remote_ts->insert_last(remote_ts, value.ts->clone(value.ts));
+                               break;
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+       child_sa->add_policies(child_sa, local_ts, remote_ts);
+       local_ts->destroy_offset(local_ts, offsetof(traffic_selector_t, destroy));
+       remote_ts->destroy_offset(remote_ts, offsetof(traffic_selector_t, destroy));
+
+       child_sa->set_state(child_sa, CHILD_INSTALLED);
+       ike_sa->add_child_sa(ike_sa, child_sa);
+       charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+}
+
+/**
+ * Process messages of type CHILD_DELETE
+ */
+static void process_child_delete(private_ha_dispatcher_t *this,
+                                                                ha_message_t *message)
+{
+       ha_message_attribute_t attribute;
+       ha_message_value_t value;
+       enumerator_t *enumerator;
+       ike_sa_t *ike_sa = NULL;
+
+       enumerator = message->create_attribute_enumerator(message);
+       while (enumerator->enumerate(enumerator, &attribute, &value))
+       {
+               switch (attribute)
+               {
+                       case HA_IKE_ID:
+                               ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
+                                                                                                                 value.ike_sa_id);
+                               break;
+                       case HA_INBOUND_SPI:
+                               if (ike_sa)
+                               {
+                                       ike_sa->destroy_child_sa(ike_sa, PROTO_ESP, value.u32);
+                               }
+                               break;
+                       default:
+                               break;
+               }
+       }
+       if (ike_sa)
+       {
+               charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Process messages of type SEGMENT_TAKE/DROP
+ */
+static void process_segment(private_ha_dispatcher_t *this,
+                                                       ha_message_t *message, bool take)
+{
+       ha_message_attribute_t attribute;
+       ha_message_value_t value;
+       enumerator_t *enumerator;
+
+       enumerator = message->create_attribute_enumerator(message);
+       while (enumerator->enumerate(enumerator, &attribute, &value))
+       {
+               switch (attribute)
+               {
+                       case HA_SEGMENT:
+                               if (take)
+                               {
+                                       DBG1(DBG_CFG, "remote node takes segment %d", value.u16);
+                                       this->segments->deactivate(this->segments, value.u16, FALSE);
+                               }
+                               else
+                               {
+                                       DBG1(DBG_CFG, "remote node drops segment %d", value.u16);
+                                       this->segments->activate(this->segments, value.u16, FALSE);
+                               }
+                               break;
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Process messages of type STATUS
+ */
+static void process_status(private_ha_dispatcher_t *this,
+                                                  ha_message_t *message)
+{
+       ha_message_attribute_t attribute;
+       ha_message_value_t value;
+       enumerator_t *enumerator;
+       segment_mask_t mask = 0;
+
+       enumerator = message->create_attribute_enumerator(message);
+       while (enumerator->enumerate(enumerator, &attribute, &value))
+       {
+               switch (attribute)
+               {
+                       case HA_SEGMENT:
+                               mask |= SEGMENTS_BIT(value.u16);
+                               break;
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+
+       this->segments->handle_status(this->segments, mask);
+}
+
+/**
+ * Process messages of type RESYNC
+ */
+static void process_resync(private_ha_dispatcher_t *this,
+                                                  ha_message_t *message)
+{
+       ha_message_attribute_t attribute;
+       ha_message_value_t value;
+       enumerator_t *enumerator;
+
+       enumerator = message->create_attribute_enumerator(message);
+       while (enumerator->enumerate(enumerator, &attribute, &value))
+       {
+               switch (attribute)
+               {
+                       case HA_SEGMENT:
+                               this->segments->resync(this->segments, value.u16);
+                               break;
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Dispatcher job function
+ */
+static job_requeue_t dispatch(private_ha_dispatcher_t *this)
+{
+       ha_message_t *message;
+
+       message = this->socket->pull(this->socket);
+       switch (message->get_type(message))
+       {
+               case HA_IKE_ADD:
+                       process_ike_add(this, message);
+                       break;
+               case HA_IKE_UPDATE:
+                       process_ike_update(this, message);
+                       break;
+               case HA_IKE_DELETE:
+                       process_ike_delete(this, message);
+                       break;
+               case HA_CHILD_ADD:
+                       process_child_add(this, message);
+                       break;
+               case HA_CHILD_DELETE:
+                       process_child_delete(this, message);
+                       break;
+               case HA_SEGMENT_DROP:
+                       process_segment(this, message, FALSE);
+                       break;
+               case HA_SEGMENT_TAKE:
+                       process_segment(this, message, TRUE);
+                       break;
+               case HA_STATUS:
+                       process_status(this, message);
+                       break;
+               case HA_RESYNC:
+                       process_resync(this, message);
+                       break;
+               default:
+                       DBG1(DBG_CFG, "received unknown HA message type %d",
+                                message->get_type(message));
+                       break;
+       }
+       message->destroy(message);
+
+       return JOB_REQUEUE_DIRECT;
+}
+
+/**
+ * Implementation of ha_dispatcher_t.destroy.
+ */
+static void destroy(private_ha_dispatcher_t *this)
+{
+       this->job->cancel(this->job);
+       free(this);
+}
+
+/**
+ * See header
+ */
+ha_dispatcher_t *ha_dispatcher_create(ha_socket_t *socket,
+                                                                         ha_segments_t *segments)
+{
+       private_ha_dispatcher_t *this = malloc_thing(private_ha_dispatcher_t);
+
+       this->public.destroy = (void(*)(ha_dispatcher_t*))destroy;
+
+       this->socket = socket;
+       this->segments = segments;
+       this->job = callback_job_create((callback_job_cb_t)dispatch,
+                                                                       this, NULL, NULL);
+       charon->processor->queue_job(charon->processor, (job_t*)this->job);
+
+       return &this->public;
+}
+
diff --git a/src/libcharon/plugins/ha/ha_dispatcher.h b/src/libcharon/plugins/ha/ha_dispatcher.h
new file mode 100644 (file)
index 0000000..d2baace
--- /dev/null
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ha_dispatcher ha_dispatcher
+ * @{ @ingroup ha
+ */
+
+#ifndef HA_DISPATCHER_H_
+#define HA_DISPATCHER_H_
+
+#include "ha_socket.h"
+#include "ha_segments.h"
+
+typedef struct ha_dispatcher_t ha_dispatcher_t;
+
+/**
+ * The dispatcher pulls messages in a thread an processes them.
+ */
+struct ha_dispatcher_t {
+
+       /**
+        * Destroy a ha_dispatcher_t.
+        */
+       void (*destroy)(ha_dispatcher_t *this);
+};
+
+/**
+ * Create a ha_dispatcher instance pulling from socket.
+ *
+ * @param socket               socket to pull messages from
+ * @param segments             segments to control based on received messages
+ * @return                             dispatcher object
+ */
+ha_dispatcher_t *ha_dispatcher_create(ha_socket_t *socket,
+                                                                         ha_segments_t *segments);
+
+#endif /* HA_DISPATCHER_ @}*/
diff --git a/src/libcharon/plugins/ha/ha_ike.c b/src/libcharon/plugins/ha/ha_ike.c
new file mode 100644 (file)
index 0000000..501c79b
--- /dev/null
@@ -0,0 +1,286 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ha_ike.h"
+
+typedef struct private_ha_ike_t private_ha_ike_t;
+
+/**
+ * Private data of an ha_ike_t object.
+ */
+struct private_ha_ike_t {
+
+       /**
+        * Public ha_ike_t interface.
+        */
+       ha_ike_t public;
+
+       /**
+        * socket we use for syncing
+        */
+       ha_socket_t *socket;
+
+       /**
+        * tunnel securing sync messages
+        */
+       ha_tunnel_t *tunnel;
+};
+
+/**
+ * Return condition if it is set on ike_sa
+ */
+static ike_condition_t copy_condition(ike_sa_t *ike_sa, ike_condition_t cond)
+{
+       if (ike_sa->has_condition(ike_sa, cond))
+       {
+               return cond;
+       }
+       return 0;
+}
+
+/**
+ * Return extension if it is supported by peers IKE_SA
+ */
+static ike_extension_t copy_extension(ike_sa_t *ike_sa, ike_extension_t ext)
+{
+       if (ike_sa->supports_extension(ike_sa, ext))
+       {
+               return ext;
+       }
+       return 0;
+}
+
+/**
+ * Implementation of listener_t.ike_keys
+ */
+static bool ike_keys(private_ha_ike_t *this, ike_sa_t *ike_sa,
+                                        diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r,
+                                        ike_sa_t *rekey)
+{
+       ha_message_t *m;
+       chunk_t secret;
+       proposal_t *proposal;
+       u_int16_t alg, len;
+
+       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
+       {       /* do not sync SA between nodes */
+               return TRUE;
+       }
+       if (dh->get_shared_secret(dh, &secret) != SUCCESS)
+       {
+               return TRUE;
+       }
+
+       m = ha_message_create(HA_IKE_ADD);
+       m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
+
+       if (rekey)
+       {
+               chunk_t skd;
+               keymat_t *keymat;
+
+               keymat = rekey->get_keymat(rekey);
+               m->add_attribute(m, HA_IKE_REKEY_ID, rekey->get_id(rekey));
+               m->add_attribute(m, HA_ALG_OLD_PRF, keymat->get_skd(keymat, &skd));
+               m->add_attribute(m, HA_OLD_SKD, skd);
+       }
+
+       proposal = ike_sa->get_proposal(ike_sa);
+       if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &len))
+       {
+               m->add_attribute(m, HA_ALG_ENCR, alg);
+               if (len)
+               {
+                       m->add_attribute(m, HA_ALG_ENCR_LEN, len);
+               }
+       }
+       if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
+       {
+               m->add_attribute(m, HA_ALG_INTEG, alg);
+       }
+       if (proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL))
+       {
+               m->add_attribute(m, HA_ALG_PRF, alg);
+       }
+       m->add_attribute(m, HA_NONCE_I, nonce_i);
+       m->add_attribute(m, HA_NONCE_R, nonce_r);
+       m->add_attribute(m, HA_SECRET, secret);
+       chunk_clear(&secret);
+
+       this->socket->push(this->socket, m);
+
+       return TRUE;
+}
+
+/**
+ * Implementation of listener_t.ike_updown
+ */
+static bool ike_updown(private_ha_ike_t *this, ike_sa_t *ike_sa, bool up)
+{
+       ha_message_t *m;
+
+       if (ike_sa->get_state(ike_sa) == IKE_PASSIVE)
+       {       /* only sync active IKE_SAs */
+               return TRUE;
+       }
+       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
+       {       /* do not sync SA between nodes */
+               return TRUE;
+       }
+
+       if (up)
+       {
+               iterator_t *iterator;
+               peer_cfg_t *peer_cfg;
+               u_int32_t extension, condition;
+               host_t *addr;
+               identification_t *eap_id;
+               ike_sa_id_t *id;
+
+               peer_cfg = ike_sa->get_peer_cfg(ike_sa);
+
+               condition = copy_condition(ike_sa, COND_NAT_ANY)
+                                 | copy_condition(ike_sa, COND_NAT_HERE)
+                                 | copy_condition(ike_sa, COND_NAT_THERE)
+                                 | copy_condition(ike_sa, COND_NAT_FAKE)
+                                 | copy_condition(ike_sa, COND_EAP_AUTHENTICATED)
+                                 | copy_condition(ike_sa, COND_CERTREQ_SEEN)
+                                 | copy_condition(ike_sa, COND_ORIGINAL_INITIATOR);
+
+               extension = copy_extension(ike_sa, EXT_NATT)
+                                 | copy_extension(ike_sa, EXT_MOBIKE)
+                                 | copy_extension(ike_sa, EXT_HASH_AND_URL);
+
+               eap_id = ike_sa->get_eap_identity(ike_sa);
+               id = ike_sa->get_id(ike_sa);
+
+               m = ha_message_create(HA_IKE_UPDATE);
+               m->add_attribute(m, HA_IKE_ID, id);
+               m->add_attribute(m, HA_LOCAL_ID, ike_sa->get_my_id(ike_sa));
+               m->add_attribute(m, HA_REMOTE_ID, ike_sa->get_other_id(ike_sa));
+               m->add_attribute(m, HA_LOCAL_ADDR, ike_sa->get_my_host(ike_sa));
+               m->add_attribute(m, HA_REMOTE_ADDR, ike_sa->get_other_host(ike_sa));
+               m->add_attribute(m, HA_CONDITIONS, condition);
+               m->add_attribute(m, HA_EXTENSIONS, extension);
+               m->add_attribute(m, HA_CONFIG_NAME, peer_cfg->get_name(peer_cfg));
+               if (eap_id)
+               {
+                       m->add_attribute(m, HA_EAP_ID, eap_id);
+               }
+               iterator = ike_sa->create_additional_address_iterator(ike_sa);
+               while (iterator->iterate(iterator, (void**)&addr))
+               {
+                       m->add_attribute(m, HA_ADDITIONAL_ADDR, addr);
+               }
+               iterator->destroy(iterator);
+       }
+       else
+       {
+               m = ha_message_create(HA_IKE_DELETE);
+               m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
+       }
+       this->socket->push(this->socket, m);
+       return TRUE;
+}
+
+/**
+ * Implementation of listener_t.ike_rekey
+ */
+static bool ike_rekey(private_ha_ike_t *this, ike_sa_t *old, ike_sa_t *new)
+{
+       ike_updown(this, old, FALSE);
+       ike_updown(this, new, TRUE);
+       return TRUE;
+}
+
+/**
+ * Implementation of listener_t.message
+ */
+static bool message_hook(private_ha_ike_t *this, ike_sa_t *ike_sa,
+                                                message_t *message, bool incoming)
+{
+       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
+       {       /* do not sync SA between nodes */
+               return TRUE;
+       }
+
+       if (message->get_exchange_type(message) != IKE_SA_INIT &&
+               message->get_request(message))
+       {       /* we sync on requests, but skip it on IKE_SA_INIT */
+               ha_message_t *m;
+               u_int32_t mid;
+
+               m = ha_message_create(HA_IKE_UPDATE);
+               m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
+               mid = message->get_message_id(message) + 1;
+               if (incoming)
+               {
+                       m->add_attribute(m, HA_RESPOND_MID, mid);
+               }
+               else
+               {
+                       m->add_attribute(m, HA_INITIATE_MID, mid);
+               }
+               this->socket->push(this->socket, m);
+       }
+       if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
+               message->get_exchange_type(message) == IKE_AUTH &&
+               !message->get_request(message))
+       {       /* After IKE_SA has been established, sync peers virtual IP.
+                * We cannot sync it in the state_change hook, it is installed later.
+                * TODO: where to sync local VIP? */
+               ha_message_t *m;
+               host_t *vip;
+
+               vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
+               if (vip)
+               {
+                       m = ha_message_create(HA_IKE_UPDATE);
+                       m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
+                       m->add_attribute(m, HA_REMOTE_VIP, vip);
+                       this->socket->push(this->socket, m);
+               }
+       }
+       return TRUE;
+}
+
+/**
+ * Implementation of ha_ike_t.destroy.
+ */
+static void destroy(private_ha_ike_t *this)
+{
+       free(this);
+}
+
+/**
+ * See header
+ */
+ha_ike_t *ha_ike_create(ha_socket_t *socket, ha_tunnel_t *tunnel)
+{
+       private_ha_ike_t *this = malloc_thing(private_ha_ike_t);
+
+       memset(&this->public.listener, 0, sizeof(listener_t));
+       this->public.listener.ike_keys = (bool(*)(listener_t*, ike_sa_t *ike_sa, diffie_hellman_t *dh,chunk_t nonce_i, chunk_t nonce_r, ike_sa_t *rekey))ike_keys;
+       this->public.listener.ike_updown = (bool(*)(listener_t*,ike_sa_t *ike_sa, bool up))ike_updown;
+       this->public.listener.ike_rekey = (bool(*)(listener_t*,ike_sa_t *old, ike_sa_t *new))ike_rekey;
+       this->public.listener.message = (bool(*)(listener_t*, ike_sa_t *, message_t *,bool))message_hook;
+       this->public.destroy = (void(*)(ha_ike_t*))destroy;
+
+       this->socket = socket;
+       this->tunnel = tunnel;
+
+       return &this->public;
+}
+
diff --git a/src/libcharon/plugins/ha/ha_ike.h b/src/libcharon/plugins/ha/ha_ike.h
new file mode 100644 (file)
index 0000000..9de210e
--- /dev/null
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ha_ike ha_ike
+ * @{ @ingroup ha
+ */
+
+#ifndef HA_IKE_H_
+#define HA_IKE_H_
+
+#include "ha_socket.h"
+#include "ha_tunnel.h"
+#include "ha_segments.h"
+
+#include <daemon.h>
+
+typedef struct ha_ike_t ha_ike_t;
+
+/**
+ * Listener to synchronize IKE_SAs.
+ */
+struct ha_ike_t {
+
+       /**
+        * Implements bus listener interface.
+        */
+       listener_t listener;
+
+       /**
+        * Destroy a ha_ike_t.
+        */
+       void (*destroy)(ha_ike_t *this);
+};
+
+/**
+ * Create a ha_ike instance.
+ *
+ * @param socket               socket to use for sending synchronization messages
+ * @param tunnel               tunnel securing sync messages, if any
+ * @return                             IKE listener
+ */
+ha_ike_t *ha_ike_create(ha_socket_t *socket, ha_tunnel_t *tunnel);
+
+#endif /* HA_IKE_ @}*/
diff --git a/src/libcharon/plugins/ha/ha_kernel.c b/src/libcharon/plugins/ha/ha_kernel.c
new file mode 100644 (file)
index 0000000..0ad9c22
--- /dev/null
@@ -0,0 +1,229 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ha_kernel.h"
+
+typedef u_int32_t u32;
+typedef u_int8_t u8;
+
+#include <linux/jhash.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#define CLUSTERIP_DIR "/proc/net/ipt_CLUSTERIP"
+
+typedef struct private_ha_kernel_t private_ha_kernel_t;
+
+/**
+ * Private data of an ha_kernel_t object.
+ */
+struct private_ha_kernel_t {
+
+       /**
+        * Public ha_kernel_t interface.
+        */
+       ha_kernel_t public;
+
+       /**
+        * Init value for jhash
+        */
+       u_int initval;
+
+       /**
+        * Total number of ClusterIP segments
+        */
+       u_int count;
+};
+
+/**
+ * Implementation of ha_kernel_t.in_segment
+ */
+static bool in_segment(private_ha_kernel_t *this, host_t *host, u_int segment)
+{
+       if (host->get_family(host) == AF_INET)
+       {
+               unsigned long hash;
+               u_int32_t addr;
+
+               addr = *(u_int32_t*)host->get_address(host).ptr;
+               hash = jhash_1word(ntohl(addr), this->initval);
+
+               if ((((u_int64_t)hash * this->count) >> 32) + 1 == segment)
+               {
+                       return TRUE;
+               }
+       }
+       return FALSE;
+}
+
+/**
+ * Activate/Deactivate a segment for a given clusterip file
+ */
+static void enable_disable(private_ha_kernel_t *this, u_int segment,
+                                                  char *file, bool enable)
+{
+       char cmd[8];
+       int fd;
+
+       snprintf(cmd, sizeof(cmd), "%c%d\n", enable ? '+' : '-', segment);
+
+       fd = open(file, O_WRONLY);
+       if (fd == -1)
+       {
+               DBG1(DBG_CFG, "opening CLUSTERIP file '%s' failed: %s",
+                        file, strerror(errno));
+               return;
+       }
+       if (write(fd, cmd, strlen(cmd) == -1))
+       {
+               DBG1(DBG_CFG, "writing to CLUSTERIP file '%s' failed: %s",
+                        file, strerror(errno));
+       }
+       close(fd);
+}
+
+/**
+ * Get the currenlty active segments in the kernel for a clusterip file
+ */
+static segment_mask_t get_active(private_ha_kernel_t *this, char *file)
+{
+       char buf[256];
+       segment_mask_t mask = 0;
+       ssize_t len;
+       int fd;
+
+       fd = open(file, O_RDONLY);
+       if (fd == -1)
+       {
+               DBG1(DBG_CFG, "opening CLUSTERIP file '%s' failed: %s",
+                        file, strerror(errno));
+               return 0;
+       }
+       len = read(fd, buf, sizeof(buf)-1);
+       if (len == -1)
+       {
+               DBG1(DBG_CFG, "reading from CLUSTERIP file '%s' failed: %s",
+                        file, strerror(errno));
+       }
+       else
+       {
+               enumerator_t *enumerator;
+               u_int segment;
+               char *token;
+
+               buf[len] = '\0';
+               enumerator = enumerator_create_token(buf, ",", " ");
+               while (enumerator->enumerate(enumerator, &token))
+               {
+                       segment = atoi(token);
+                       if (segment)
+                       {
+                               mask |= SEGMENTS_BIT(segment);
+                       }
+               }
+               enumerator->destroy(enumerator);
+       }
+       return mask;
+}
+
+/**
+ * Implementation of ha_kernel_t.activate
+ */
+static void activate(private_ha_kernel_t *this, u_int segment)
+{
+       enumerator_t *enumerator;
+       char *file;
+
+       enumerator = enumerator_create_directory(CLUSTERIP_DIR);
+       while (enumerator->enumerate(enumerator, NULL, &file, NULL))
+       {
+               enable_disable(this, segment, file, TRUE);
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Implementation of ha_kernel_t.deactivate
+ */
+static void deactivate(private_ha_kernel_t *this, u_int segment)
+{
+       enumerator_t *enumerator;
+       char *file;
+
+       enumerator = enumerator_create_directory(CLUSTERIP_DIR);
+       while (enumerator->enumerate(enumerator, NULL, &file, NULL))
+       {
+               enable_disable(this, segment, file, FALSE);
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Disable all not-yet disabled segments on all clusterip addresses
+ */
+static void disable_all(private_ha_kernel_t *this)
+{
+       enumerator_t *enumerator;
+       segment_mask_t active;
+       char *file;
+       int i;
+
+       enumerator = enumerator_create_directory(CLUSTERIP_DIR);
+       while (enumerator->enumerate(enumerator, NULL, &file, NULL))
+       {
+               active = get_active(this, file);
+               for (i = 1; i <= this->count; i++)
+               {
+                       if (active & SEGMENTS_BIT(i))
+                       {
+                               enable_disable(this, i, file, FALSE);
+                       }
+               }
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Implementation of ha_kernel_t.destroy.
+ */
+static void destroy(private_ha_kernel_t *this)
+{
+       free(this);
+}
+
+/**
+ * See header
+ */
+ha_kernel_t *ha_kernel_create(u_int count)
+{
+       private_ha_kernel_t *this = malloc_thing(private_ha_kernel_t);
+
+       this->public.in_segment = (bool(*)(ha_kernel_t*, host_t *host, u_int segment))in_segment;
+       this->public.activate = (void(*)(ha_kernel_t*, u_int segment))activate;
+       this->public.deactivate = (void(*)(ha_kernel_t*, u_int segment))deactivate;
+       this->public.destroy = (void(*)(ha_kernel_t*))destroy;
+
+       this->initval = 0;
+       this->count = count;
+
+       disable_all(this);
+
+       return &this->public;
+}
+
diff --git a/src/libcharon/plugins/ha/ha_kernel.h b/src/libcharon/plugins/ha/ha_kernel.h
new file mode 100644 (file)
index 0000000..b37cc76
--- /dev/null
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ha_kernel ha_kernel
+ * @{ @ingroup ha
+ */
+
+#ifndef HA_KERNEL_H_
+#define HA_KERNEL_H_
+
+typedef struct ha_kernel_t ha_kernel_t;
+
+#include "ha_segments.h"
+
+/**
+ * HA segment kernel configuration interface.
+ */
+struct ha_kernel_t {
+
+       /**
+        * Check if a host is in a segment.
+        *
+        * @param host          host to check
+        * @param segment       segment
+        * @return                      TRUE if host belongs to segment
+        */
+       bool (*in_segment)(ha_kernel_t *this, host_t *host, u_int segment);
+
+       /**
+        * Activate a segment at kernel level for all cluster addresses.
+        *
+        * @param segment       segment to activate
+        */
+       void (*activate)(ha_kernel_t *this, u_int segment);
+
+       /**
+        * Deactivate a segment at kernel level for all cluster addresses.
+        *
+        * @param segment       segment to deactivate
+        */
+       void (*deactivate)(ha_kernel_t *this, u_int segment);
+
+       /**
+        * Destroy a ha_kernel_t.
+        */
+       void (*destroy)(ha_kernel_t *this);
+};
+
+/**
+ * Create a ha_kernel instance.
+ *
+ * @param count                        total number of segments to use
+ * @param active               bitmask of initially active segments
+ */
+ha_kernel_t *ha_kernel_create(u_int count);
+
+#endif /* HA_KERNEL_ @}*/
diff --git a/src/libcharon/plugins/ha/ha_message.c b/src/libcharon/plugins/ha/ha_message.c
new file mode 100644 (file)
index 0000000..cd6c90a
--- /dev/null
@@ -0,0 +1,665 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#define _GNU_SOURCE
+#include <string.h>
+#include <arpa/inet.h>
+
+#include "ha_message.h"
+
+#include <daemon.h>
+
+#define ALLOCATION_BLOCK 64
+
+typedef struct private_ha_message_t private_ha_message_t;
+
+/**
+ * Private data of an ha_message_t object.
+ */
+struct private_ha_message_t {
+
+       /**
+        * Public ha_message_t interface.
+        */
+       ha_message_t public;
+
+       /**
+        * Allocated size of buf
+        */
+       size_t allocated;
+
+       /**
+        * Buffer containing encoded data
+        */
+       chunk_t buf;
+};
+
+typedef struct ike_sa_id_encoding_t ike_sa_id_encoding_t;
+
+/**
+ * Encoding if an ike_sa_id_t
+ */
+struct ike_sa_id_encoding_t {
+       u_int64_t initiator_spi;
+       u_int64_t responder_spi;
+       u_int8_t initiator;
+} __attribute__((packed));
+
+typedef struct identification_encoding_t identification_encoding_t;
+
+/**
+ * Encoding of a identification_t
+ */
+struct identification_encoding_t {
+       u_int8_t type;
+       u_int8_t len;
+       char encoding[];
+} __attribute__((packed));
+
+typedef struct host_encoding_t host_encoding_t;
+
+/**
+ * encoding of a host_t
+ */
+struct host_encoding_t {
+       u_int16_t port;
+       u_int8_t family;
+       char encoding[];
+} __attribute__((packed));
+
+typedef struct ts_encoding_t ts_encoding_t;
+
+/**
+ * encoding of a traffic_selector_t
+ */
+struct ts_encoding_t {
+       u_int8_t type;
+       u_int8_t protocol;
+       u_int16_t from_port;
+       u_int16_t to_port;
+       u_int8_t dynamic;
+       char encoding[];
+} __attribute__((packed));
+
+/**
+ * Implementation of ha_message_t.get_type
+ */
+static ha_message_type_t get_type(private_ha_message_t *this)
+{
+       return this->buf.ptr[1];
+}
+
+/**
+ * check for space in buffer, increase if necessary
+ */
+static void check_buf(private_ha_message_t *this, size_t len)
+{
+       int increased = 0;
+
+       while (this->buf.len + len > this->allocated)
+       {       /* double size */
+               this->allocated += ALLOCATION_BLOCK;
+               increased++;
+       }
+       if (increased)
+       {
+               this->buf.ptr = realloc(this->buf.ptr, this->allocated);
+       }
+}
+
+/**
+ * Implementation of ha_message_t.add_attribute
+ */
+static void add_attribute(private_ha_message_t *this,
+                                                 ha_message_attribute_t attribute, ...)
+{
+       size_t len;
+       va_list args;
+
+       check_buf(this, sizeof(u_int8_t));
+       this->buf.ptr[this->buf.len] = attribute;
+       this->buf.len += sizeof(u_int8_t);
+
+       va_start(args, attribute);
+       switch (attribute)
+       {
+               /* ike_sa_id_t* */
+               case HA_IKE_ID:
+               case HA_IKE_REKEY_ID:
+               {
+                       ike_sa_id_encoding_t *enc;
+                       ike_sa_id_t *id;
+
+                       id = va_arg(args, ike_sa_id_t*);
+                       check_buf(this, sizeof(ike_sa_id_encoding_t));
+                       enc = (ike_sa_id_encoding_t*)(this->buf.ptr + this->buf.len);
+                       this->buf.len += sizeof(ike_sa_id_encoding_t);
+                       enc->initiator = id->is_initiator(id);
+                       enc->initiator_spi = id->get_initiator_spi(id);
+                       enc->responder_spi = id->get_responder_spi(id);
+                       break;
+               }
+               /* identification_t* */
+               case HA_LOCAL_ID:
+               case HA_REMOTE_ID:
+               case HA_EAP_ID:
+               {
+                       identification_encoding_t *enc;
+                       identification_t *id;
+                       chunk_t data;
+
+                       id = va_arg(args, identification_t*);
+                       data = id->get_encoding(id);
+                       check_buf(this, sizeof(identification_encoding_t) + data.len);
+                       enc = (identification_encoding_t*)(this->buf.ptr + this->buf.len);
+                       this->buf.len += sizeof(identification_encoding_t) + data.len;
+                       enc->type = id->get_type(id);
+                       enc->len = data.len;
+                       memcpy(enc->encoding, data.ptr, data.len);
+                       break;
+               }
+               /* host_t* */
+               case HA_LOCAL_ADDR:
+               case HA_REMOTE_ADDR:
+               case HA_LOCAL_VIP:
+               case HA_REMOTE_VIP:
+               case HA_ADDITIONAL_ADDR:
+               {
+                       host_encoding_t *enc;
+                       host_t *host;
+                       chunk_t data;
+
+                       host = va_arg(args, host_t*);
+                       data = host->get_address(host);
+                       check_buf(this, sizeof(host_encoding_t) + data.len);
+                       enc = (host_encoding_t*)(this->buf.ptr + this->buf.len);
+                       this->buf.len += sizeof(host_encoding_t) + data.len;
+                       enc->family = host->get_family(host);
+                       enc->port = htons(host->get_port(host));
+                       memcpy(enc->encoding, data.ptr, data.len);
+                       break;
+               }
+               /* char* */
+               case HA_CONFIG_NAME:
+               {
+                       char *str;
+
+                       str = va_arg(args, char*);
+                       len = strlen(str) + 1;
+                       check_buf(this, len);
+                       memcpy(this->buf.ptr + this->buf.len, str, len);
+                       this->buf.len += len;
+                       break;
+               }
+               /* u_int8_t */
+               case HA_IPSEC_MODE:
+               case HA_IPCOMP:
+               {
+                       u_int8_t val;
+
+                       val = va_arg(args, u_int);
+                       check_buf(this, sizeof(val));
+                       this->buf.ptr[this->buf.len] = val;
+                       this->buf.len += sizeof(val);
+                       break;
+               }
+               /* u_int16_t */
+               case HA_ALG_PRF:
+               case HA_ALG_OLD_PRF:
+               case HA_ALG_ENCR:
+               case HA_ALG_ENCR_LEN:
+               case HA_ALG_INTEG:
+               case HA_INBOUND_CPI:
+               case HA_OUTBOUND_CPI:
+               case HA_SEGMENT:
+               {
+                       u_int16_t val;
+
+                       val = va_arg(args, u_int);
+                       check_buf(this, sizeof(val));
+                       *(u_int16_t*)(this->buf.ptr + this->buf.len) = htons(val);
+                       this->buf.len += sizeof(val);
+                       break;
+               }
+               /** u_int32_t */
+               case HA_CONDITIONS:
+               case HA_EXTENSIONS:
+               case HA_INBOUND_SPI:
+               case HA_OUTBOUND_SPI:
+               case HA_INITIATE_MID:
+               case HA_RESPOND_MID:
+               {
+                       u_int32_t val;
+
+                       val = va_arg(args, u_int);
+                       check_buf(this, sizeof(val));
+                       *(u_int32_t*)(this->buf.ptr + this->buf.len) = htonl(val);
+                       this->buf.len += sizeof(val);
+                       break;
+               }
+               /** chunk_t */
+               case HA_NONCE_I:
+               case HA_NONCE_R:
+               case HA_SECRET:
+               case HA_OLD_SKD:
+               {
+                       chunk_t chunk;
+
+                       chunk = va_arg(args, chunk_t);
+                       check_buf(this, chunk.len + sizeof(u_int16_t));
+                       *(u_int16_t*)(this->buf.ptr + this->buf.len) = htons(chunk.len);
+                       memcpy(this->buf.ptr + this->buf.len + sizeof(u_int16_t),
+                                  chunk.ptr, chunk.len);
+                       this->buf.len += chunk.len + sizeof(u_int16_t);;
+                       break;
+               }
+               /** traffic_selector_t */
+               case HA_LOCAL_TS:
+               case HA_REMOTE_TS:
+               {
+                       ts_encoding_t *enc;
+                       traffic_selector_t *ts;
+                       chunk_t data;
+
+                       ts = va_arg(args, traffic_selector_t*);
+                       data = chunk_cata("cc", ts->get_from_address(ts),
+                                                         ts->get_to_address(ts));
+                       check_buf(this, sizeof(ts_encoding_t) + data.len);
+                       enc = (ts_encoding_t*)(this->buf.ptr + this->buf.len);
+                       this->buf.len += sizeof(ts_encoding_t) + data.len;
+                       enc->type = ts->get_type(ts);
+                       enc->protocol = ts->get_protocol(ts);
+                       enc->from_port = htons(ts->get_from_port(ts));
+                       enc->to_port = htons(ts->get_to_port(ts));
+                       enc->dynamic = ts->is_dynamic(ts);
+                       memcpy(enc->encoding, data.ptr, data.len);
+                       break;
+               }
+               default:
+               {
+                       DBG1(DBG_CFG, "unable to encode, attribute %d unknown", attribute);
+                       this->buf.len -= sizeof(u_int8_t);
+                       break;
+               }
+       }
+       va_end(args);
+}
+
+/**
+ * Attribute enumerator implementation
+ */
+typedef struct {
+       /** implementes enumerator_t */
+       enumerator_t public;
+       /** position in message */
+       chunk_t buf;
+       /** cleanup handler of current element, if any */
+       void (*cleanup)(void* data);
+       /** data to pass to cleanup handler */
+       void *cleanup_data;
+} attribute_enumerator_t;
+
+/**
+ * Implementation of create_attribute_enumerator().enumerate
+ */
+static bool attribute_enumerate(attribute_enumerator_t *this,
+                                                               ha_message_attribute_t *attr_out,
+                                                               ha_message_value_t *value)
+{
+       ha_message_attribute_t attr;
+
+       if (this->cleanup)
+       {
+               this->cleanup(this->cleanup_data);
+               this->cleanup = NULL;
+       }
+       if (this->buf.len < 1)
+       {
+               return FALSE;
+       }
+       attr = this->buf.ptr[0];
+       this->buf = chunk_skip(this->buf, 1);
+       switch (attr)
+       {
+               /* ike_sa_id_t* */
+               case HA_IKE_ID:
+               case HA_IKE_REKEY_ID:
+               {
+                       ike_sa_id_encoding_t *enc;
+
+                       if (this->buf.len < sizeof(ike_sa_id_encoding_t))
+                       {
+                               return FALSE;
+                       }
+                       enc = (ike_sa_id_encoding_t*)(this->buf.ptr);
+                       value->ike_sa_id = ike_sa_id_create(enc->initiator_spi,
+                                                                                       enc->responder_spi, enc->initiator);
+                       *attr_out = attr;
+                       this->cleanup = (void*)value->ike_sa_id->destroy;
+                       this->cleanup_data = value->ike_sa_id;
+                       this->buf = chunk_skip(this->buf, sizeof(ike_sa_id_encoding_t));
+                       return TRUE;
+               }
+               /* identification_t* */
+               case HA_LOCAL_ID:
+               case HA_REMOTE_ID:
+               case HA_EAP_ID:
+               {
+                       identification_encoding_t *enc;
+
+                       enc = (identification_encoding_t*)(this->buf.ptr);
+                       if (this->buf.len < sizeof(identification_encoding_t) ||
+                               this->buf.len < sizeof(identification_encoding_t) + enc->len)
+                       {
+                               return FALSE;
+                       }
+                       value->id = identification_create_from_encoding(enc->type,
+                                                                               chunk_create(enc->encoding, enc->len));
+                       *attr_out = attr;
+                       this->cleanup = (void*)value->id->destroy;
+                       this->cleanup_data = value->id;
+                       this->buf = chunk_skip(this->buf,
+                                                               sizeof(identification_encoding_t) + enc->len);
+                       return TRUE;
+               }
+               /* host_t* */
+               case HA_LOCAL_ADDR:
+               case HA_REMOTE_ADDR:
+               case HA_LOCAL_VIP:
+               case HA_REMOTE_VIP:
+               case HA_ADDITIONAL_ADDR:
+               {
+                       host_encoding_t *enc;
+
+                       enc = (host_encoding_t*)(this->buf.ptr);
+                       if (this->buf.len < sizeof(host_encoding_t))
+                       {
+                               return FALSE;
+                       }
+                       value->host = host_create_from_chunk(enc->family,
+                                                                       chunk_create(enc->encoding,
+                                                                               this->buf.len - sizeof(host_encoding_t)),
+                                                                       ntohs(enc->port));
+                       if (!value->host)
+                       {
+                               return FALSE;
+                       }
+                       *attr_out = attr;
+                       this->cleanup = (void*)value->host->destroy;
+                       this->cleanup_data = value->host;
+                       this->buf = chunk_skip(this->buf, sizeof(host_encoding_t) +
+                                                                  value->host->get_address(value->host).len);
+                       return TRUE;
+               }
+               /* char* */
+               case HA_CONFIG_NAME:
+               {
+                       size_t len;
+
+                       len = strnlen(this->buf.ptr, this->buf.len);
+                       if (len >= this->buf.len)
+                       {
+                               return FALSE;
+                       }
+                       value->str = this->buf.ptr;
+                       *attr_out = attr;
+                       this->buf = chunk_skip(this->buf, len + 1);
+                       return TRUE;
+               }
+               /* u_int8_t */
+               case HA_IPSEC_MODE:
+               case HA_IPCOMP:
+               {
+                       if (this->buf.len < sizeof(u_int8_t))
+                       {
+                               return FALSE;
+                       }
+                       value->u8 = *(u_int8_t*)this->buf.ptr;
+                       *attr_out = attr;
+                       this->buf = chunk_skip(this->buf, sizeof(u_int8_t));
+                       return TRUE;
+               }
+               /** u_int16_t */
+               case HA_ALG_PRF:
+               case HA_ALG_OLD_PRF:
+               case HA_ALG_ENCR:
+               case HA_ALG_ENCR_LEN:
+               case HA_ALG_INTEG:
+               case HA_INBOUND_CPI:
+               case HA_OUTBOUND_CPI:
+               case HA_SEGMENT:
+               {
+                       if (this->buf.len < sizeof(u_int16_t))
+                       {
+                               return FALSE;
+                       }
+                       value->u16 = ntohs(*(u_int16_t*)this->buf.ptr);
+                       *attr_out = attr;
+                       this->buf = chunk_skip(this->buf, sizeof(u_int16_t));
+                       return TRUE;
+               }
+               /** u_int32_t */
+               case HA_CONDITIONS:
+               case HA_EXTENSIONS:
+               case HA_INBOUND_SPI:
+               case HA_OUTBOUND_SPI:
+               case HA_INITIATE_MID:
+               case HA_RESPOND_MID:
+               {
+                       if (this->buf.len < sizeof(u_int32_t))
+                       {
+                               return FALSE;
+                       }
+                       value->u32 = ntohl(*(u_int32_t*)this->buf.ptr);
+                       *attr_out = attr;
+                       this->buf = chunk_skip(this->buf, sizeof(u_int32_t));
+                       return TRUE;
+               }
+               /** chunk_t */
+               case HA_NONCE_I:
+               case HA_NONCE_R:
+               case HA_SECRET:
+               case HA_OLD_SKD:
+               {
+                       size_t len;
+
+                       if (this->buf.len < sizeof(u_int16_t))
+                       {
+                               return FALSE;
+                       }
+                       len = ntohs(*(u_int16_t*)this->buf.ptr);
+                       this->buf = chunk_skip(this->buf, sizeof(u_int16_t));
+                       if (this->buf.len < len)
+                       {
+                               return FALSE;
+                       }
+                       value->chunk.len = len;
+                       value->chunk.ptr = this->buf.ptr;
+                       *attr_out = attr;
+                       this->buf = chunk_skip(this->buf, len);
+                       return TRUE;
+               }
+               case HA_LOCAL_TS:
+               case HA_REMOTE_TS:
+               {
+                       ts_encoding_t *enc;
+                       host_t *host;
+                       int addr_len;
+
+                       enc = (ts_encoding_t*)(this->buf.ptr);
+                       if (this->buf.len < sizeof(ts_encoding_t))
+                       {
+                               return FALSE;
+                       }
+                       switch (enc->type)
+                       {
+                               case TS_IPV4_ADDR_RANGE:
+                                       addr_len = 4;
+                                       if (this->buf.len < sizeof(ts_encoding_t) + 2 * addr_len)
+                                       {
+                                               return FALSE;
+                                       }
+                                       break;
+                               case TS_IPV6_ADDR_RANGE:
+                                       addr_len = 16;
+                                       if (this->buf.len < sizeof(ts_encoding_t) + 2 * addr_len)
+                                       {
+                                               return FALSE;
+                                       }
+                                       break;
+                               default:
+                                       return FALSE;
+                       }
+                       if (enc->dynamic)
+                       {
+                               host = host_create_from_chunk(0,
+                                                                       chunk_create(enc->encoding, addr_len), 0);
+                               if (!host)
+                               {
+                                       return FALSE;
+                               }
+                               value->ts = traffic_selector_create_dynamic(enc->protocol,
+                                                                       ntohs(enc->from_port), ntohs(enc->to_port));
+                               value->ts->set_address(value->ts, host);
+                               host->destroy(host);
+                       }
+                       else
+                       {
+                               value->ts = traffic_selector_create_from_bytes(enc->protocol,
+                                                               enc->type, chunk_create(enc->encoding, addr_len),
+                                                               ntohs(enc->from_port),
+                                                               chunk_create(enc->encoding + addr_len, addr_len),
+                                                               ntohs(enc->to_port));
+                               if (!value->ts)
+                               {
+                                       return FALSE;
+                               }
+                       }
+                       *attr_out = attr;
+                       this->cleanup = (void*)value->ts->destroy;
+                       this->cleanup_data = value->ts;
+                       this->buf = chunk_skip(this->buf, sizeof(ts_encoding_t)
+                                                                               + addr_len * 2);
+                       return TRUE;
+               }
+               default:
+               {
+                       return FALSE;
+               }
+       }
+}
+
+/**
+ * Implementation of create_attribute_enumerator().destroy
+ */
+static void enum_destroy(attribute_enumerator_t *this)
+{
+       if (this->cleanup)
+       {
+               this->cleanup(this->cleanup_data);
+       }
+       free(this);
+}
+
+/**
+ * Implementation of ha_message_t.create_attribute_enumerator
+ */
+static enumerator_t* create_attribute_enumerator(private_ha_message_t *this)
+{
+       attribute_enumerator_t *e = malloc_thing(attribute_enumerator_t);
+
+       e->public.enumerate = (void*)attribute_enumerate;
+       e->public.destroy = (void*)enum_destroy;
+
+       e->buf = chunk_skip(this->buf, 2);
+       e->cleanup = NULL;
+       e->cleanup_data = NULL;
+
+       return &e->public;
+}
+
+/**
+ * Implementation of ha_message_t.get_encoding
+ */
+static chunk_t get_encoding(private_ha_message_t *this)
+{
+       return this->buf;
+}
+
+/**
+ * Implementation of ha_message_t.destroy.
+ */
+static void destroy(private_ha_message_t *this)
+{
+       free(this->buf.ptr);
+       free(this);
+}
+
+
+static private_ha_message_t *ha_message_create_generic()
+{
+       private_ha_message_t *this = malloc_thing(private_ha_message_t);
+
+       this->public.get_type = (ha_message_type_t(*)(ha_message_t*))get_type;
+       this->public.add_attribute = (void(*)(ha_message_t*, ha_message_attribute_t attribute, ...))add_attribute;
+       this->public.create_attribute_enumerator = (enumerator_t*(*)(ha_message_t*))create_attribute_enumerator;
+       this->public.get_encoding = (chunk_t(*)(ha_message_t*))get_encoding;
+       this->public.destroy = (void(*)(ha_message_t*))destroy;
+
+       return this;
+}
+
+/**
+ * See header
+ */
+ha_message_t *ha_message_create(ha_message_type_t type)
+{
+       private_ha_message_t *this = ha_message_create_generic();
+
+       this->allocated = ALLOCATION_BLOCK;
+       this->buf.ptr = malloc(this->allocated);
+       this->buf.len = 2;
+       this->buf.ptr[0] = HA_MESSAGE_VERSION;
+       this->buf.ptr[1] = type;
+
+       return &this->public;
+}
+
+/**
+ * See header
+ */
+ha_message_t *ha_message_parse(chunk_t data)
+{
+       private_ha_message_t *this;
+
+       if (data.len < 2)
+       {
+               DBG1(DBG_CFG, "HA message too short");
+               return NULL;
+       }
+       if (data.ptr[0] != HA_MESSAGE_VERSION)
+       {
+               DBG1(DBG_CFG, "HA message has version %d, expected %d",
+                        data.ptr[0], HA_MESSAGE_VERSION);
+               return NULL;
+       }
+
+       this = ha_message_create_generic();
+       this->buf = chunk_clone(data);
+       this->allocated = this->buf.len;
+
+       return &this->public;
+}
+
diff --git a/src/libcharon/plugins/ha/ha_message.h b/src/libcharon/plugins/ha/ha_message.h
new file mode 100644 (file)
index 0000000..6204132
--- /dev/null
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ha_message ha_message
+ * @{ @ingroup ha
+ */
+
+#ifndef HA_MESSAGE_H_
+#define HA_MESSAGE_H_
+
+#include <library.h>
+#include <utils/host.h>
+#include <utils/identification.h>
+#include <sa/ike_sa_id.h>
+#include <config/traffic_selector.h>
+
+/**
+ * Protocol version of this implementation
+ */
+#define HA_MESSAGE_VERSION 1
+
+typedef struct ha_message_t ha_message_t;
+typedef enum ha_message_type_t ha_message_type_t;
+typedef enum ha_message_attribute_t ha_message_attribute_t;
+typedef union ha_message_value_t ha_message_value_t;
+
+/**
+ * Type of a HA message
+ */
+enum ha_message_type_t {
+       /** add a completely new IKE_SA */
+       HA_IKE_ADD = 1,
+       /** update an existing IKE_SA (message IDs, address update, ...) */
+       HA_IKE_UPDATE,
+       /** delete an existing IKE_SA */
+       HA_IKE_DELETE,
+       /** add a new CHILD_SA */
+       HA_CHILD_ADD,
+       /** delete an existing CHILD_SA */
+       HA_CHILD_DELETE,
+       /** segments the sending node is giving up */
+       HA_SEGMENT_DROP,
+       /** segments the sending node is taking over */
+       HA_SEGMENT_TAKE,
+       /** status with the segments the sending node is currently serving */
+       HA_STATUS,
+       /** segments the receiving node is requested to resync */
+       HA_RESYNC,
+};
+
+/**
+ * Type of attributes contained in a message
+ */
+enum ha_message_attribute_t {
+       /** ike_sa_id_t*, to identify IKE_SA */
+       HA_IKE_ID = 1,
+       /** ike_Sa_id_t*, identifies IKE_SA which gets rekeyed */
+       HA_IKE_REKEY_ID,
+       /** identification_t*, local identity */
+       HA_LOCAL_ID,
+       /** identification_t*, remote identity */
+       HA_REMOTE_ID,
+       /** identification_t*, EAP identity */
+       HA_EAP_ID,
+       /** host_t*, local address */
+       HA_LOCAL_ADDR,
+       /** host_t*, remote address */
+       HA_REMOTE_ADDR,
+       /** char*, name of configuration */
+       HA_CONFIG_NAME,
+       /** u_int32_t, bitset of ike_condition_t */
+       HA_CONDITIONS,
+       /** u_int32_t, bitset of ike_extension_t */
+       HA_EXTENSIONS,
+       /** host_t*, local virtual IP */
+       HA_LOCAL_VIP,
+       /** host_t*, remote virtual IP */
+       HA_REMOTE_VIP,
+       /** host_t*, additional MOBIKE peer address */
+       HA_ADDITIONAL_ADDR,
+       /** chunk_t, initiators nonce */
+       HA_NONCE_I,
+       /** chunk_t, responders nonce */
+       HA_NONCE_R,
+       /** chunk_t, diffie hellman shared secret */
+       HA_SECRET,
+       /** chunk_t, SKd of old SA if rekeying */
+       HA_OLD_SKD,
+       /** u_int16_t, pseudo random function */
+       HA_ALG_PRF,
+       /** u_int16_t, old pseudo random function if rekeying */
+       HA_ALG_OLD_PRF,
+       /** u_int16_t, encryption algorithm */
+       HA_ALG_ENCR,
+       /** u_int16_t, encryption key size in bytes */
+       HA_ALG_ENCR_LEN,
+       /** u_int16_t, integrity protection algorithm */
+       HA_ALG_INTEG,
+       /** u_int8_t, IPsec mode, TUNNEL|TRANSPORT|... */
+       HA_IPSEC_MODE,
+       /** u_int8_t, IPComp protocol */
+       HA_IPCOMP,
+       /** u_int32_t, inbound security parameter index */
+       HA_INBOUND_SPI,
+       /** u_int32_t, outbound security parameter index */
+       HA_OUTBOUND_SPI,
+       /** u_int16_t, inbound security parameter index */
+       HA_INBOUND_CPI,
+       /** u_int16_t, outbound security parameter index */
+       HA_OUTBOUND_CPI,
+       /** traffic_selector_t*, local traffic selector */
+       HA_LOCAL_TS,
+       /** traffic_selector_t*, remote traffic selector */
+       HA_REMOTE_TS,
+       /** u_int32_t, initiating message ID */
+       HA_INITIATE_MID,
+       /** u_int32_t, responding message ID */
+       HA_RESPOND_MID,
+       /** u_int16_t, HA segment */
+       HA_SEGMENT,
+};
+
+/**
+ * Union to enumerate typed attributes in a message
+ */
+union ha_message_value_t {
+       u_int8_t u8;
+       u_int16_t u16;
+       u_int32_t u32;
+       char *str;
+       chunk_t chunk;
+       ike_sa_id_t *ike_sa_id;
+       identification_t *id;
+       host_t *host;
+       traffic_selector_t *ts;
+};
+
+/**
+ * Abstracted message passed between nodes in a HA cluster.
+ */
+struct ha_message_t {
+
+       /**
+        * Get the type of the message.
+        *
+        * @return              message type
+        */
+       ha_message_type_t (*get_type)(ha_message_t *this);
+
+       /**
+        * Add an attribute to a message.
+        *
+        * @param attribute             attribute type to add
+        * @param ...                   attribute specific data
+        */
+       void (*add_attribute)(ha_message_t *this,
+                                                 ha_message_attribute_t attribute, ...);
+
+       /**
+        * Create an enumerator over all attributes in a message.
+        *
+        * @return                              enumerator over attribute, ha_message_value_t
+        */
+       enumerator_t* (*create_attribute_enumerator)(ha_message_t *this);
+
+       /**
+        * Get the message in a encoded form.
+        *
+        * @return                              chunk pointing to internal data
+        */
+       chunk_t (*get_encoding)(ha_message_t *this);
+
+       /**
+        * Destroy a ha_message_t.
+        */
+       void (*destroy)(ha_message_t *this);
+};
+
+/**
+ * Create a new ha_message instance, ready for adding attributes
+ *
+ * @param version                      protocol version to create a message from
+ * @param type                         type of the message
+ */
+ha_message_t *ha_message_create(ha_message_type_t type);
+
+/**
+ * Create a ha_message from encoded data.
+ *
+ * @param data                         encoded message data
+ */
+ha_message_t *ha_message_parse(chunk_t data);
+
+#endif /* HA_MESSAGE_ @}*/
diff --git a/src/libcharon/plugins/ha/ha_plugin.c b/src/libcharon/plugins/ha/ha_plugin.c
new file mode 100644 (file)
index 0000000..661db8a
--- /dev/null
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ha_plugin.h"
+#include "ha_ike.h"
+#include "ha_child.h"
+#include "ha_socket.h"
+#include "ha_tunnel.h"
+#include "ha_dispatcher.h"
+#include "ha_segments.h"
+#include "ha_ctl.h"
+
+#include <daemon.h>
+#include <config/child_cfg.h>
+
+typedef struct private_ha_plugin_t private_ha_plugin_t;
+
+/**
+ * private data of ha plugin
+ */
+struct private_ha_plugin_t {
+
+       /**
+        * implements plugin interface
+        */
+       ha_plugin_t public;
+
+       /**
+        * Communication socket
+        */
+       ha_socket_t *socket;
+
+       /**
+        * Tunnel securing sync messages.
+        */
+       ha_tunnel_t *tunnel;
+
+       /**
+        * IKE_SA synchronization
+        */
+       ha_ike_t *ike;
+
+       /**
+        * CHILD_SA synchronization
+        */
+       ha_child_t *child;
+
+       /**
+        * Dispatcher to process incoming messages
+        */
+       ha_dispatcher_t *dispatcher;
+
+       /**
+        * Active/Passive segment management
+        */
+       ha_segments_t *segments;
+
+       /**
+        * Interface to control segments at kernel level
+        */
+       ha_kernel_t *kernel;
+
+       /**
+        * Segment control interface via FIFO
+        */
+       ha_ctl_t *ctl;
+};
+
+/**
+ * Implementation of plugin_t.destroy
+ */
+static void destroy(private_ha_plugin_t *this)
+{
+       DESTROY_IF(this->ctl);
+       charon->bus->remove_listener(charon->bus, &this->segments->listener);
+       charon->bus->remove_listener(charon->bus, &this->ike->listener);
+       charon->bus->remove_listener(charon->bus, &this->child->listener);
+       this->ike->destroy(this->ike);
+       this->child->destroy(this->child);
+       this->dispatcher->destroy(this->dispatcher);
+       this->segments->destroy(this->segments);
+       this->kernel->destroy(this->kernel);
+       this->socket->destroy(this->socket);
+       DESTROY_IF(this->tunnel);
+       free(this);
+}
+
+/*
+ * see header file
+ */
+plugin_t *plugin_create()
+{
+       private_ha_plugin_t *this;
+       char *local, *remote, *secret;
+       u_int count;
+       bool fifo, monitor, resync;
+
+       local = lib->settings->get_str(lib->settings,
+                                                               "charon.plugins.ha.local", NULL);
+       remote = lib->settings->get_str(lib->settings,
+                                                               "charon.plugins.ha.remote", NULL);
+       secret = lib->settings->get_str(lib->settings,
+                                                               "charon.plugins.ha.secret", NULL);
+       fifo = lib->settings->get_bool(lib->settings,
+                                                               "charon.plugins.ha.fifo_interface", TRUE);
+       monitor = lib->settings->get_bool(lib->settings,
+                                                               "charon.plugins.ha.monitor", TRUE);
+       resync = lib->settings->get_bool(lib->settings,
+                                                               "charon.plugins.ha.resync", TRUE);
+       count = min(SEGMENTS_MAX, lib->settings->get_int(lib->settings,
+                                                               "charon.plugins.ha.segment_count", 1));
+       if (!local || !remote)
+       {
+               DBG1(DBG_CFG, "HA config misses local/remote address");
+               return NULL;
+       }
+
+       this = malloc_thing(private_ha_plugin_t);
+
+       this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
+       this->tunnel = NULL;
+       this->ctl = NULL;
+
+       if (secret)
+       {
+               this->tunnel = ha_tunnel_create(local, remote, secret);
+       }
+       this->socket = ha_socket_create(local, remote);
+       if (!this->socket)
+       {
+               DESTROY_IF(this->tunnel);
+               free(this);
+               return NULL;
+       }
+       this->kernel = ha_kernel_create(count);
+       this->segments = ha_segments_create(this->socket, this->kernel, this->tunnel,
+                                                       count, strcmp(local, remote) > 0, monitor, resync);
+       if (fifo)
+       {
+               this->ctl = ha_ctl_create(this->segments);
+       }
+       this->dispatcher = ha_dispatcher_create(this->socket, this->segments);
+       this->ike = ha_ike_create(this->socket, this->tunnel);
+       this->child = ha_child_create(this->socket, this->tunnel);
+       charon->bus->add_listener(charon->bus, &this->segments->listener);
+       charon->bus->add_listener(charon->bus, &this->ike->listener);
+       charon->bus->add_listener(charon->bus, &this->child->listener);
+
+       return &this->public.plugin;
+}
+
diff --git a/src/libcharon/plugins/ha/ha_plugin.h b/src/libcharon/plugins/ha/ha_plugin.h
new file mode 100644 (file)
index 0000000..e83712f
--- /dev/null
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ha ha
+ * @ingroup cplugins
+ *
+ * @defgroup ha_plugin ha_plugin
+ * @{ @ingroup ha
+ */
+
+#ifndef HA_PLUGIN_H_
+#define HA_PLUGIN_H_
+
+#include <plugins/plugin.h>
+
+/**
+ * UDP port we use for communication
+ */
+#define HA_PORT 4510
+
+typedef struct ha_plugin_t ha_plugin_t;
+
+/**
+ * Plugin to synchronize state in a high availability cluster.
+ */
+struct ha_plugin_t {
+
+       /**
+        * implements plugin interface
+        */
+       plugin_t plugin;
+};
+
+/**
+ * Create a ha_plugin instance.
+ */
+plugin_t *plugin_create();
+
+#endif /* HA_PLUGIN_H_ @}*/
diff --git a/src/libcharon/plugins/ha/ha_segments.c b/src/libcharon/plugins/ha/ha_segments.c
new file mode 100644 (file)
index 0000000..3575d05
--- /dev/null
@@ -0,0 +1,502 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ha_segments.h"
+
+#include <pthread.h>
+
+#include <utils/mutex.h>
+#include <utils/linked_list.h>
+#include <processing/jobs/callback_job.h>
+
+#define HEARTBEAT_DELAY 1000
+#define HEARTBEAT_TIMEOUT 2100
+
+typedef struct private_ha_segments_t private_ha_segments_t;
+
+/**
+ * Private data of an ha_segments_t object.
+ */
+struct private_ha_segments_t {
+
+       /**
+        * Public ha_segments_t interface.
+        */
+       ha_segments_t public;
+
+       /**
+        * communication socket
+        */
+       ha_socket_t *socket;
+
+       /**
+        * Sync tunnel, if any
+        */
+       ha_tunnel_t *tunnel;
+
+       /**
+        * Interface to control segments at kernel level
+        */
+       ha_kernel_t *kernel;
+
+       /**
+        * Mutex to lock segment manipulation
+        */
+       mutex_t *mutex;
+
+       /**
+        * Condvar to wait for heartbeats
+        */
+       condvar_t *condvar;
+
+       /**
+        * Job checking for heartbeats
+        */
+       callback_job_t *job;
+
+       /**
+        * Total number of ClusterIP segments
+        */
+       u_int count;
+
+       /**
+        * mask of active segments
+        */
+       segment_mask_t active;
+
+       /**
+        * Node number
+        */
+       u_int node;
+};
+
+/**
+ * Log currently active segments
+ */
+static void log_segments(private_ha_segments_t *this, bool activated,
+                                                u_int segment)
+{
+       char buf[64] = "none", *pos = buf;
+       int i;
+       bool first = TRUE;
+
+       for (i = 1; i <= this->count; i++)
+       {
+               if (this->active & SEGMENTS_BIT(i))
+               {
+                       if (first)
+                       {
+                               first = FALSE;
+                       }
+                       else
+                       {
+                               pos += snprintf(pos, buf + sizeof(buf) - pos, ",");
+                       }
+                       pos += snprintf(pos, buf + sizeof(buf) - pos, "%d", i);
+               }
+       }
+       DBG1(DBG_CFG, "HA segment %d %sactivated, now active: %s",
+                segment, activated ? "" : "de", buf);
+}
+
+/**
+ * Enable/Disable a specific segment
+ */
+static void enable_disable(private_ha_segments_t *this, u_int segment,
+                                                  bool enable, bool notify)
+{
+       ike_sa_t *ike_sa;
+       enumerator_t *enumerator;
+       ike_sa_state_t old, new;
+       ha_message_t *message = NULL;
+       ha_message_type_t type;
+       bool changes = FALSE;
+
+       if (segment > this->count)
+       {
+               return;
+       }
+
+       if (enable)
+       {
+               old = IKE_PASSIVE;
+               new = IKE_ESTABLISHED;
+               type = HA_SEGMENT_TAKE;
+               if (!(this->active & SEGMENTS_BIT(segment)))
+               {
+                       this->active |= SEGMENTS_BIT(segment);
+                       this->kernel->activate(this->kernel, segment);
+                       changes = TRUE;
+               }
+       }
+       else
+       {
+               old = IKE_ESTABLISHED;
+               new = IKE_PASSIVE;
+               type = HA_SEGMENT_DROP;
+               if (this->active & SEGMENTS_BIT(segment))
+               {
+                       this->active &= ~SEGMENTS_BIT(segment);
+                       this->kernel->deactivate(this->kernel, segment);
+                       changes = TRUE;
+               }
+       }
+
+       if (changes)
+       {
+               enumerator = charon->ike_sa_manager->create_enumerator(charon->ike_sa_manager);
+               while (enumerator->enumerate(enumerator, &ike_sa))
+               {
+                       if (ike_sa->get_state(ike_sa) != old)
+                       {
+                               continue;
+                       }
+                       if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
+                       {
+                               continue;
+                       }
+                       if (this->kernel->in_segment(this->kernel,
+                                                                       ike_sa->get_other_host(ike_sa), segment))
+                       {
+                               ike_sa->set_state(ike_sa, new);
+                       }
+               }
+               enumerator->destroy(enumerator);
+               log_segments(this, enable, segment);
+       }
+
+       if (notify)
+       {
+               message = ha_message_create(type);
+               message->add_attribute(message, HA_SEGMENT, segment);
+               this->socket->push(this->socket, message);
+       }
+}
+
+/**
+ * Enable/Disable all or a specific segment, do locking
+ */
+static void enable_disable_all(private_ha_segments_t *this, u_int segment,
+                                                          bool enable, bool notify)
+{
+       int i;
+
+       this->mutex->lock(this->mutex);
+       if (segment == 0)
+       {
+               for (i = 1; i <= this->count; i++)
+               {
+                       enable_disable(this, i, enable, notify);
+               }
+       }
+       else
+       {
+               enable_disable(this, segment, enable, notify);
+       }
+       this->mutex->unlock(this->mutex);
+}
+
+/**
+ * Implementation of ha_segments_t.activate
+ */
+static void activate(private_ha_segments_t *this, u_int segment, bool notify)
+{
+       enable_disable_all(this, segment, TRUE, notify);
+}
+
+/**
+ * Implementation of ha_segments_t.deactivate
+ */
+static void deactivate(private_ha_segments_t *this, u_int segment, bool notify)
+{
+       enable_disable_all(this, segment, FALSE, notify);
+}
+
+/**
+ * Rekey all children of an IKE_SA
+ */
+static status_t rekey_children(ike_sa_t *ike_sa)
+{
+       iterator_t *iterator;
+       child_sa_t *child_sa;
+       status_t status = SUCCESS;
+
+       iterator = ike_sa->create_child_sa_iterator(ike_sa);
+       while (iterator->iterate(iterator, (void**)&child_sa))
+       {
+               DBG1(DBG_CFG, "resyncing CHILD_SA");
+               status = ike_sa->rekey_child_sa(ike_sa, child_sa->get_protocol(child_sa),
+                                                                               child_sa->get_spi(child_sa, TRUE));
+               if (status == DESTROY_ME)
+               {
+                       break;
+               }
+       }
+       iterator->destroy(iterator);
+       return status;
+}
+
+/**
+ * Implementation of ha_segments_t.resync
+ */
+static void resync(private_ha_segments_t *this, u_int segment)
+{
+       ike_sa_t *ike_sa;
+       enumerator_t *enumerator;
+       linked_list_t *list;
+       ike_sa_id_t *id;
+
+       list = linked_list_create();
+       this->mutex->lock(this->mutex);
+
+       if (segment > 0 && segment <= this->count)
+       {
+               DBG1(DBG_CFG, "resyncing HA segment %d", segment);
+
+               /* we do the actual rekeying in a seperate loop to avoid rekeying
+                * an SA twice. */
+               enumerator = charon->ike_sa_manager->create_enumerator(
+                                                                                                       charon->ike_sa_manager);
+               while (enumerator->enumerate(enumerator, &ike_sa))
+               {
+                       if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
+                               this->kernel->in_segment(this->kernel,
+                                                                       ike_sa->get_other_host(ike_sa), segment))
+                       {
+                               id = ike_sa->get_id(ike_sa);
+                               list->insert_last(list, id->clone(id));
+                       }
+               }
+               enumerator->destroy(enumerator);
+       }
+       this->mutex->unlock(this->mutex);
+
+       while (list->remove_last(list, (void**)&id) == SUCCESS)
+       {
+               ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, id);
+               id->destroy(id);
+               if (ike_sa)
+               {
+                       DBG1(DBG_CFG, "resyncing IKE_SA");
+                       if (ike_sa->rekey(ike_sa) != DESTROY_ME)
+                       {
+                               if (rekey_children(ike_sa) != DESTROY_ME)
+                               {
+                                       charon->ike_sa_manager->checkin(
+                                                                               charon->ike_sa_manager, ike_sa);
+                                       continue;
+                               }
+                       }
+                       charon->ike_sa_manager->checkin_and_destroy(
+                                                                               charon->ike_sa_manager, ike_sa);
+               }
+       }
+       list->destroy(list);
+}
+
+/**
+ * Implementation of listener_t.alert
+ */
+static bool alert_hook(private_ha_segments_t *this, ike_sa_t *ike_sa,
+                                          alert_t alert, va_list args)
+{
+       if (alert == ALERT_SHUTDOWN_SIGNAL)
+       {
+               deactivate(this, 0, TRUE);
+       }
+       return TRUE;
+}
+
+/**
+ * Request a resync of all segments
+ */
+static job_requeue_t request_resync(private_ha_segments_t *this)
+{
+       ha_message_t *message;
+       int i;
+
+       message = ha_message_create(HA_RESYNC);
+       for (i = 1; i <= this->count; i++)
+       {
+               message->add_attribute(message, HA_SEGMENT, i);
+       }
+       this->socket->push(this->socket, message);
+       return JOB_REQUEUE_NONE;
+}
+
+/**
+ * Monitor heartbeat activity of remote node
+ */
+static job_requeue_t watchdog(private_ha_segments_t *this)
+{
+       int oldstate;
+       bool timeout;
+
+       this->mutex->lock(this->mutex);
+       pthread_cleanup_push((void*)this->mutex->unlock, this->mutex);
+       pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+       timeout = this->condvar->timed_wait(this->condvar, this->mutex,
+                                                                               HEARTBEAT_TIMEOUT);
+       pthread_setcancelstate(oldstate, NULL);
+       pthread_cleanup_pop(TRUE);
+       if (timeout)
+       {
+               DBG1(DBG_CFG, "no heartbeat received, taking all segments");
+               activate(this, 0, TRUE);
+               /* disable heartbeat detection util we get one */
+               this->job = NULL;
+               return JOB_REQUEUE_NONE;
+       }
+       return JOB_REQUEUE_DIRECT;
+}
+
+/**
+ * Start the heartbeat detection thread
+ */
+static void start_watchdog(private_ha_segments_t *this)
+{
+       this->job = callback_job_create((callback_job_cb_t)watchdog,
+                                                                       this, NULL, NULL);
+       charon->processor->queue_job(charon->processor, (job_t*)this->job);
+}
+
+/**
+ * Implementation of ha_segments_t.handle_status
+ */
+static void handle_status(private_ha_segments_t *this, segment_mask_t mask)
+{
+       segment_mask_t missing;
+       int i;
+
+       this->mutex->lock(this->mutex);
+
+       missing = ~(this->active | mask);
+
+       for (i = 1; i <= this->count; i++)
+       {
+               if (missing & SEGMENTS_BIT(i))
+               {
+                       if (this->node == i % 2)
+                       {
+                               DBG1(DBG_CFG, "HA segment %d was not handled, taking", i);
+                               enable_disable(this, i, TRUE, TRUE);
+                       }
+                       else
+                       {
+                               DBG1(DBG_CFG, "HA segment %d was not handled, dropping", i);
+                               enable_disable(this, i, FALSE, TRUE);
+                       }
+               }
+       }
+
+       this->mutex->unlock(this->mutex);
+       this->condvar->signal(this->condvar);
+
+       if (!this->job)
+       {
+               DBG1(DBG_CFG, "received heartbeat, reenabling watchdog");
+               start_watchdog(this);
+       }
+}
+
+/**
+ * Send a status message with our active segments
+ */
+static job_requeue_t send_status(private_ha_segments_t *this)
+{
+       ha_message_t *message;
+       int i;
+
+       message = ha_message_create(HA_STATUS);
+
+       for (i = 1; i <= this->count; i++)
+       {
+               if (this->active & SEGMENTS_BIT(i))
+               {
+                       message->add_attribute(message, HA_SEGMENT, i);
+               }
+       }
+
+       this->socket->push(this->socket, message);
+
+       /* schedule next invocation */
+       charon->scheduler->schedule_job_ms(charon->scheduler, (job_t*)
+                                                                       callback_job_create((callback_job_cb_t)
+                                                                               send_status, this, NULL, NULL),
+                                                                       HEARTBEAT_DELAY);
+
+       return JOB_REQUEUE_NONE;
+}
+
+/**
+ * Implementation of ha_segments_t.destroy.
+ */
+static void destroy(private_ha_segments_t *this)
+{
+       if (this->job)
+       {
+               this->job->cancel(this->job);
+       }
+       this->mutex->destroy(this->mutex);
+       this->condvar->destroy(this->condvar);
+       free(this);
+}
+
+/**
+ * See header
+ */
+ha_segments_t *ha_segments_create(ha_socket_t *socket, ha_kernel_t *kernel,
+                                                                 ha_tunnel_t *tunnel, u_int count, u_int node,
+                                                                 bool monitor, bool sync)
+{
+       private_ha_segments_t *this = malloc_thing(private_ha_segments_t);
+
+       memset(&this->public.listener, 0, sizeof(listener_t));
+       this->public.listener.alert = (bool(*)(listener_t*, ike_sa_t *, alert_t, va_list))alert_hook;
+       this->public.activate = (void(*)(ha_segments_t*, u_int segment,bool))activate;
+       this->public.deactivate = (void(*)(ha_segments_t*, u_int segment,bool))deactivate;
+       this->public.resync = (void(*)(ha_segments_t*, u_int segment))resync;
+       this->public.handle_status = (void(*)(ha_segments_t*, segment_mask_t mask))handle_status;
+       this->public.destroy = (void(*)(ha_segments_t*))destroy;
+
+       this->socket = socket;
+       this->tunnel = tunnel;
+       this->kernel = kernel;
+       this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
+       this->condvar = condvar_create(CONDVAR_TYPE_DEFAULT);
+       this->count = count;
+       this->node = node;
+       this->job = NULL;
+
+       /* initially all segments are deactivated */
+       this->active = 0;
+
+       if (monitor)
+       {
+               send_status(this);
+               start_watchdog(this);
+       }
+
+       if (sync)
+       {
+               /* request a resync as soon as we are up */
+               charon->processor->queue_job(charon->processor, (job_t*)
+                                               callback_job_create((callback_job_cb_t)request_resync,
+                                                                                       this, NULL, NULL));
+       }
+
+       return &this->public;
+}
+
diff --git a/src/libcharon/plugins/ha/ha_segments.h b/src/libcharon/plugins/ha/ha_segments.h
new file mode 100644 (file)
index 0000000..6d1cd54
--- /dev/null
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ha_segments ha_segments
+ * @{ @ingroup ha
+ */
+
+#ifndef HA_SEGMENTS_H_
+#define HA_SEGMENTS_H_
+
+#include <daemon.h>
+
+typedef struct ha_segments_t ha_segments_t;
+
+typedef u_int16_t segment_mask_t;
+
+/**
+ * maximum number of segments
+ */
+#define SEGMENTS_MAX (sizeof(segment_mask_t)*8)
+
+/**
+ * Get the bit in the mask of a segment
+ */
+#define SEGMENTS_BIT(segment) (0x01 << (segment - 1))
+
+#include "ha_socket.h"
+#include "ha_tunnel.h"
+#include "ha_kernel.h"
+
+/**
+ * Segmentation of peers into active and passive.
+ */
+struct ha_segments_t {
+
+       /**
+        * Implements listener interface to catch daemon shutdown.
+        */
+       listener_t listener;
+
+       /**
+        * Activate a set of IKE_SAs identified by a segment.
+        *
+        * @param segment       numerical segment to takeover, 0 for all
+        * @param notify        wheter to notify other nodes about activation
+        */
+       void (*activate)(ha_segments_t *this, u_int segment, bool notify);
+
+       /**
+        * Deactivate a set of IKE_SAs identified by a segment.
+        *
+        * @param segment       numerical segment to takeover, 0 for all
+        * @param notify        wheter to notify other nodes about deactivation
+        */
+       void (*deactivate)(ha_segments_t *this, u_int segment, bool notify);
+
+       /**
+        * Resync an active segment.
+        *
+        * To reintegrade a node into the cluster, resynchronization is reqired.
+        * IKE_SAs and CHILD_SAs are synced automatically during rekeying. A call
+        * to this method enforces a rekeying immediately sync all state of a
+        * segment.
+        *
+        * @param segment       segment to resync
+        */
+       void (*resync)(ha_segments_t *this, u_int segment);
+
+       /**
+        * Handle a status message from the remote node.
+        *
+        * @param mask          segments the remote node is serving actively
+        */
+       void (*handle_status)(ha_segments_t *this, segment_mask_t mask);
+
+       /**
+        * Destroy a ha_segments_t.
+        */
+       void (*destroy)(ha_segments_t *this);
+};
+
+/**
+ * Create a ha_segments instance.
+ *
+ * @param socket               socket to communicate segment (de-)activation
+ * @param kernel               interface to control segments at kernel level
+ * @param tunnel               HA tunnel
+ * @param count                        number of segments the cluster uses
+ * @param node                 node, currently 1 or 0
+ * @param monitor              should we use monitoring functionality
+ * @param resync               request a complete resync on startup
+ * @return                             segment object
+ */
+ha_segments_t *ha_segments_create(ha_socket_t *socket, ha_kernel_t *kernel,
+                                                                 ha_tunnel_t *tunnel, u_int count, u_int node,
+                                                                 bool monitor, bool resync);
+
+#endif /* HA_SEGMENTS_ @}*/
diff --git a/src/libcharon/plugins/ha/ha_socket.c b/src/libcharon/plugins/ha/ha_socket.c
new file mode 100644 (file)
index 0000000..b84b028
--- /dev/null
@@ -0,0 +1,234 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ha_socket.h"
+#include "ha_plugin.h"
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <errno.h>
+#include <unistd.h>
+#include <pthread.h>
+
+#include <daemon.h>
+#include <utils/host.h>
+#include <processing/jobs/callback_job.h>
+
+typedef struct private_ha_socket_t private_ha_socket_t;
+
+/**
+ * Private data of an ha_socket_t object.
+ */
+struct private_ha_socket_t {
+
+       /**
+        * Public ha_socket_t interface.
+        */
+       ha_socket_t public;
+
+       /**
+        * UDP communication socket fd
+        */
+       int fd;
+
+       /**
+        * local host to receive/send from
+        */
+       host_t *local;
+
+       /**
+        * remote host to receive/send to
+        */
+       host_t *remote;
+};
+
+/**
+ * Data to pass to the send_message() callback job
+ */
+typedef struct {
+       ha_message_t *message;
+       private_ha_socket_t *this;
+} job_data_t;
+
+/**
+ * Cleanup job data
+ */
+static void job_data_destroy(job_data_t *this)
+{
+       this->message->destroy(this->message);
+       free(this);
+}
+
+/**
+ * Callback to asynchronously send messages
+ */
+static job_requeue_t send_message(job_data_t *data)
+{
+       private_ha_socket_t *this;
+       chunk_t chunk;
+
+       this = data->this;
+       chunk = data->message->get_encoding(data->message);
+       if (send(this->fd, chunk.ptr, chunk.len, 0) < chunk.len)
+       {
+               DBG1(DBG_CFG, "pushing HA message failed: %s", strerror(errno));
+       }
+       return JOB_REQUEUE_NONE;
+}
+
+/**
+ * Implementation of ha_socket_t.push
+ */
+static void push(private_ha_socket_t *this, ha_message_t *message)
+{
+       chunk_t chunk;
+
+       /* Try to send synchronously, but non-blocking. */
+       chunk = message->get_encoding(message);
+       if (send(this->fd, chunk.ptr, chunk.len, MSG_DONTWAIT) < chunk.len)
+       {
+               if (errno == EAGAIN)
+               {
+                       callback_job_t *job;
+                       job_data_t *data;
+
+                       /* Fallback to asynchronous transmission. This is required, as sendto()
+                        * is a blocking call if it acquires a policy. We could end up in a
+                        * deadlock, as we own an IKE_SA. */
+                       data = malloc_thing(job_data_t);
+                       data->message = message;
+                       data->this = this;
+
+                       job = callback_job_create((callback_job_cb_t)send_message,
+                                                                         data, (void*)job_data_destroy, NULL);
+                       charon->processor->queue_job(charon->processor, (job_t*)job);
+                       return;
+               }
+               DBG1(DBG_CFG, "pushing HA message failed: %s", strerror(errno));
+       }
+       message->destroy(message);
+}
+
+/**
+ * Implementation of ha_socket_t.pull
+ */
+static ha_message_t *pull(private_ha_socket_t *this)
+{
+       while (TRUE)
+       {
+               ha_message_t *message;
+               char buf[1024];
+               int oldstate;
+               ssize_t len;
+
+               pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+               len = recv(this->fd, buf, sizeof(buf), 0);
+               pthread_setcancelstate(oldstate, NULL);
+               if (len <= 0)
+               {
+                       switch (errno)
+                       {
+                               case ECONNREFUSED:
+                               case EINTR:
+                                       continue;
+                               default:
+                                       DBG1(DBG_CFG, "pulling HA message failed: %s",
+                                                strerror(errno));
+                                       sleep(1);
+                       }
+               }
+               message = ha_message_parse(chunk_create(buf, len));
+               if (message)
+               {
+                       return message;
+               }
+       }
+}
+
+/**
+ * Open and connect the HA socket
+ */
+static bool open_socket(private_ha_socket_t *this)
+{
+       this->fd = socket(this->local->get_family(this->local), SOCK_DGRAM, 0);
+       if (this->fd == -1)
+       {
+               DBG1(DBG_CFG, "opening HA socket failed: %s", strerror(errno));
+               return FALSE;
+       }
+
+       if (bind(this->fd, this->local->get_sockaddr(this->local),
+                        *this->local->get_sockaddr_len(this->local)) == -1)
+       {
+               DBG1(DBG_CFG, "binding HA socket failed: %s", strerror(errno));
+               close(this->fd);
+               this->fd = -1;
+               return FALSE;
+       }
+       if (connect(this->fd, this->remote->get_sockaddr(this->remote),
+                               *this->remote->get_sockaddr_len(this->remote)) == -1)
+       {
+               DBG1(DBG_CFG, "connecting HA socket failed: %s", strerror(errno));
+               close(this->fd);
+               this->fd = -1;
+               return FALSE;
+       }
+
+       return TRUE;
+}
+
+/**
+ * Implementation of ha_socket_t.destroy.
+ */
+static void destroy(private_ha_socket_t *this)
+{
+       if (this->fd != -1)
+       {
+               close(this->fd);
+       }
+       DESTROY_IF(this->local);
+       DESTROY_IF(this->remote);
+       free(this);
+}
+
+/**
+ * See header
+ */
+ha_socket_t *ha_socket_create(char *local, char *remote)
+{
+       private_ha_socket_t *this = malloc_thing(private_ha_socket_t);
+
+       this->public.push = (void(*)(ha_socket_t*, ha_message_t*))push;
+       this->public.pull = (ha_message_t*(*)(ha_socket_t*))pull;
+       this->public.destroy = (void(*)(ha_socket_t*))destroy;
+
+       this->local = host_create_from_dns(local, 0, HA_PORT);
+       this->remote = host_create_from_dns(remote, 0, HA_PORT);
+       this->fd = -1;
+
+       if (!this->local || !this->remote)
+       {
+               DBG1(DBG_CFG, "invalid local/remote HA address");
+               destroy(this);
+               return NULL;
+       }
+       if (!open_socket(this))
+       {
+               destroy(this);
+               return NULL;
+       }
+       return &this->public;
+}
+
diff --git a/src/libcharon/plugins/ha/ha_socket.h b/src/libcharon/plugins/ha/ha_socket.h
new file mode 100644 (file)
index 0000000..8d398e2
--- /dev/null
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by