2 * Copyright (C) 2006-2017 Tobias Brunner
3 * Copyright (C) 2005-2009 Martin Willi
4 * Copyright (C) 2006 Daniel Roethlisberger
5 * Copyright (C) 2005 Jan Hutter
6 * HSR Hochschule fuer Technik Rapperswil
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
23 #include <sys/types.h>
24 #include <sys/utsname.h>
33 #include <utils/backtrace.h>
34 #include <threading/thread.h>
37 #include <private/android_filesystem_config.h> /* for AID_VPN */
41 * PID file, in which charon stores its process id
43 #define PID_FILE IPSEC_PIDDIR "/charon.pid"
46 * Default user and group
49 #define IPSEC_USER NULL
53 #define IPSEC_GROUP NULL
57 * Global reference to PID file (required to truncate, if undeletable)
59 static FILE *pidfile
= NULL
;
62 * hook in library for debugging messages
64 extern void (*dbg
) (debug_t group
, level_t level
, char *fmt
, ...);
67 * Logging hook for library logs, using stderr output
69 static void dbg_stderr(debug_t group
, level_t level
, char *fmt
, ...)
76 fprintf(stderr
, "00[%N] ", debug_names
, group
);
77 vfprintf(stderr
, fmt
, args
);
78 fprintf(stderr
, "\n");
84 * Run the daemon and handle unix signals
90 /* handle SIGINT, SIGHUP and SIGTERM in this handler */
92 sigaddset(&set
, SIGINT
);
93 sigaddset(&set
, SIGHUP
);
94 sigaddset(&set
, SIGTERM
);
95 sigprocmask(SIG_BLOCK
, &set
, NULL
);
101 sig
= sigwaitinfo(&set
, NULL
);
105 { /* ignore signals we didn't wait for */
108 DBG1(DBG_DMN
, "waiting for signal failed: %s", strerror(errno
));
115 DBG1(DBG_DMN
, "signal of type SIGHUP received. Reloading "
117 if (lib
->settings
->load_files(lib
->settings
, lib
->conf
, FALSE
))
119 charon
->load_loggers(charon
);
120 lib
->plugins
->reload(lib
->plugins
, NULL
);
124 DBG1(DBG_DMN
, "reloading config failed, keeping old");
130 DBG1(DBG_DMN
, "signal of type SIGINT received. Shutting down");
131 charon
->bus
->alert(charon
->bus
, ALERT_SHUTDOWN_SIGNAL
, sig
);
136 DBG1(DBG_DMN
, "signal of type SIGTERM received. Shutting down");
137 charon
->bus
->alert(charon
->bus
, ALERT_SHUTDOWN_SIGNAL
, sig
);
147 static bool lookup_uid_gid()
151 name
= lib
->settings
->get_str(lib
->settings
, "charon.user", IPSEC_USER
);
152 if (name
&& !lib
->caps
->resolve_uid(lib
->caps
, name
))
156 name
= lib
->settings
->get_str(lib
->settings
, "charon.group", IPSEC_GROUP
);
157 if (name
&& !lib
->caps
->resolve_gid(lib
->caps
, name
))
162 lib
->caps
->set_uid(lib
->caps
, AID_VPN
);
168 * Handle SIGSEGV/SIGILL signals raised by threads
170 static void segv_handler(int signal
)
172 backtrace_t
*backtrace
;
174 DBG1(DBG_DMN
, "thread %u received %d", thread_current_id(), signal
);
175 backtrace
= backtrace_create(2);
176 backtrace
->log(backtrace
, NULL
, TRUE
);
177 backtrace
->log(backtrace
, stderr
, TRUE
);
178 backtrace
->destroy(backtrace
);
180 DBG1(DBG_DMN
, "killing ourself, received critical signal");
185 * Check/create PID file, return TRUE if already running
187 static bool check_pidfile()
191 if (stat(PID_FILE
, &stb
) == 0)
193 pidfile
= fopen(PID_FILE
, "r");
199 memset(buf
, 0, sizeof(buf
));
200 if (fread(buf
, 1, sizeof(buf
), pidfile
))
202 buf
[sizeof(buf
) - 1] = '\0';
207 if (pid
&& pid
!= getpid() && kill(pid
, 0) == 0)
209 DBG1(DBG_DMN
, "charon already running ('"PID_FILE
"' exists)");
213 DBG1(DBG_DMN
, "removing pidfile '"PID_FILE
"', process not running");
217 /* create new pidfile */
218 pidfile
= fopen(PID_FILE
, "w");
223 fd
= fileno(pidfile
);
226 DBG1(DBG_DMN
, "unable to determine fd for '"PID_FILE
"'");
229 if (fcntl(fd
, F_SETFD
, FD_CLOEXEC
) == -1)
231 DBG1(DBG_LIB
, "setting FD_CLOEXEC for '"PID_FILE
"' failed: %s",
234 /* Only change owner of the pidfile if we have CAP_CHOWN. Otherwise,
235 * attempt to change group of pidfile to group under which charon
236 * runs after dropping caps. This requires the user that charon
238 * a) Have write access to the socket dir.
239 * b) Belong to the group that charon will run under after dropping
241 if (lib
->caps
->check(lib
->caps
, CAP_CHOWN
))
243 ignore_result(fchown(fd
,
244 lib
->caps
->get_uid(lib
->caps
),
245 lib
->caps
->get_gid(lib
->caps
)));
249 ignore_result(fchown(fd
, -1,
250 lib
->caps
->get_gid(lib
->caps
)));
252 fprintf(pidfile
, "%d\n", getpid());
258 DBG1(DBG_DMN
, "unable to create pidfile '"PID_FILE
"'");
264 * Delete/truncate the PID file
266 static void unlink_pidfile()
268 /* because unlinking the PID file may fail, we truncate it to ensure the
269 * daemon can be properly restarted. one probable cause for this is the
270 * combination of not running as root and the effective user lacking
271 * permissions on the parent dir(s) of the PID file */
274 ignore_result(ftruncate(fileno(pidfile
), 0));
281 * print command line usage and exit
283 static void usage(const char *msg
)
285 if (msg
!= NULL
&& *msg
!= '\0')
287 fprintf(stderr
, "%s\n", msg
);
289 fprintf(stderr
, "Usage: charon\n"
293 " [--debug-<type> <level>]\n"
294 " <type>: log context type (dmn|mgr|ike|chd|job|cfg|knl|net|asn|enc|tnc|imc|imv|pts|tls|esp|lib)\n"
295 " <level>: log verbosity (-1 = silent, 0 = audit, 1 = control,\n"
296 " 2 = controlmore, 3 = raw, 4 = private)\n"
302 * Main function, starts the daemon.
304 int main(int argc
, char *argv
[])
306 struct sigaction action
;
307 int group
, status
= SS_RC_INITIALIZATION_FAILED
;
308 struct utsname utsname
;
309 level_t levels
[DBG_MAX
];
310 bool use_syslog
= FALSE
;
312 /* logging for library during initialization, as we have no bus yet */
315 /* initialize library */
316 if (!library_init(NULL
, "charon"))
319 exit(SS_RC_LIBSTRONGSWAN_INTEGRITY
);
322 if (lib
->integrity
&&
323 !lib
->integrity
->check_file(lib
->integrity
, "charon", argv
[0]))
325 dbg_stderr(DBG_DMN
, 1, "integrity check of charon failed");
327 exit(SS_RC_DAEMON_INTEGRITY
);
330 if (!libcharon_init())
332 dbg_stderr(DBG_DMN
, 1, "initialization failed - aborting charon");
336 /* use CTRL loglevel for default */
337 for (group
= 0; group
< DBG_MAX
; group
++)
339 levels
[group
] = LEVEL_CTRL
;
342 /* handle arguments */
345 struct option long_opts
[] = {
346 { "help", no_argument
, NULL
, 'h' },
347 { "version", no_argument
, NULL
, 'v' },
348 { "use-syslog", no_argument
, NULL
, 'l' },
349 /* TODO: handle "debug-all" */
350 { "debug-dmn", required_argument
, &group
, DBG_DMN
},
351 { "debug-mgr", required_argument
, &group
, DBG_MGR
},
352 { "debug-ike", required_argument
, &group
, DBG_IKE
},
353 { "debug-chd", required_argument
, &group
, DBG_CHD
},
354 { "debug-job", required_argument
, &group
, DBG_JOB
},
355 { "debug-cfg", required_argument
, &group
, DBG_CFG
},
356 { "debug-knl", required_argument
, &group
, DBG_KNL
},
357 { "debug-net", required_argument
, &group
, DBG_NET
},
358 { "debug-asn", required_argument
, &group
, DBG_ASN
},
359 { "debug-enc", required_argument
, &group
, DBG_ENC
},
360 { "debug-tnc", required_argument
, &group
, DBG_TNC
},
361 { "debug-imc", required_argument
, &group
, DBG_IMC
},
362 { "debug-imv", required_argument
, &group
, DBG_IMV
},
363 { "debug-pts", required_argument
, &group
, DBG_PTS
},
364 { "debug-tls", required_argument
, &group
, DBG_TLS
},
365 { "debug-esp", required_argument
, &group
, DBG_ESP
},
366 { "debug-lib", required_argument
, &group
, DBG_LIB
},
370 int c
= getopt_long(argc
, argv
, "", long_opts
, NULL
);
380 printf("Linux strongSwan %s\n", VERSION
);
387 /* option is in group */
388 levels
[group
] = atoi(optarg
);
398 if (!lookup_uid_gid())
400 dbg_stderr(DBG_DMN
, 1, "invalid uid/gid - aborting charon");
404 charon
->set_default_loggers(charon
, levels
, !use_syslog
);
405 charon
->load_loggers(charon
);
407 if (uname(&utsname
) != 0)
409 memset(&utsname
, 0, sizeof(utsname
));
411 DBG1(DBG_DMN
, "Starting IKE charon daemon (strongSwan "VERSION
", %s %s, %s)",
412 utsname
.sysname
, utsname
.release
, utsname
.machine
);
415 DBG1(DBG_DMN
, "integrity tests enabled:");
416 DBG1(DBG_DMN
, "lib 'libstrongswan': passed file and segment integrity tests");
417 DBG1(DBG_DMN
, "lib 'libcharon': passed file and segment integrity tests");
418 DBG1(DBG_DMN
, "daemon 'charon': passed file integrity test");
421 /* initialize daemon */
422 if (!charon
->initialize(charon
,
423 lib
->settings
->get_str(lib
->settings
, "charon.load", PLUGINS
)))
425 DBG1(DBG_DMN
, "initialization failed - aborting charon");
428 lib
->plugins
->status(lib
->plugins
, LEVEL_CTRL
);
435 if (!lib
->caps
->drop(lib
->caps
))
437 DBG1(DBG_DMN
, "capability dropping failed - aborting charon");
441 /* add handler for SEGV and ILL,
442 * INT, TERM and HUP are handled by sigwaitinfo() in run() */
443 action
.sa_handler
= segv_handler
;
445 sigemptyset(&action
.sa_mask
);
446 sigaddset(&action
.sa_mask
, SIGINT
);
447 sigaddset(&action
.sa_mask
, SIGTERM
);
448 sigaddset(&action
.sa_mask
, SIGHUP
);
449 sigaction(SIGSEGV
, &action
, NULL
);
450 sigaction(SIGILL
, &action
, NULL
);
451 sigaction(SIGBUS
, &action
, NULL
);
452 action
.sa_handler
= SIG_IGN
;
453 sigaction(SIGPIPE
, &action
, NULL
);
455 pthread_sigmask(SIG_SETMASK
, &action
.sa_mask
, NULL
);
457 /* start daemon (i.e. the threads in the thread-pool) */
458 charon
->start(charon
);
460 /* main thread goes to run loop */