2 * Copyright (C) 2012-2017 Tobias Brunner
3 * Copyright (C) 2012 Reto Buerki
4 * Copyright (C) 2012 Adrian-Ken Rueegsegger
5 * HSR Hochschule fuer Technik Rapperswil
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
24 #include <sys/types.h>
32 #include <utils/backtrace.h>
33 #include <threading/thread.h>
34 #include <sa/keymat.h>
35 #include <credentials/credential_manager.h>
38 #include "tkm_nonceg.h"
39 #include "tkm_diffie_hellman.h"
40 #include "tkm_keymat.h"
41 #include "tkm_listener.h"
42 #include "tkm_kernel_ipsec.h"
43 #include "tkm_public_key.h"
45 #include "tkm_encoder.h"
46 #include "tkm_spi_generator.h"
49 * TKM bus listener for IKE authorize events.
51 static tkm_listener_t
*listener
;
56 static char *dmn_name
;
59 * PID file, in which charon-tkm stores its process id
61 static char *pidfile_name
= NULL
;
64 * Global reference to PID file (required to truncate, if undeletable)
66 static FILE *pidfile
= NULL
;
69 * Hook in library for debugging messages
71 extern void (*dbg
) (debug_t group
, level_t level
, char *fmt
, ...);
74 * Simple logging hook for library logs, using syslog output
76 static void dbg_syslog(debug_t group
, level_t level
, char *fmt
, ...)
84 /* write in memory buffer first */
85 vsnprintf(buffer
, sizeof(buffer
), fmt
, args
);
86 syslog(LOG_DAEMON
|LOG_INFO
, "00[%s] %s", debug_names
->names
[group
],
93 * Run the daemon and handle unix signals
99 /* handle SIGINT and SIGTERM in this handler */
101 sigaddset(&set
, SIGINT
);
102 sigaddset(&set
, SIGTERM
);
103 sigprocmask(SIG_BLOCK
, &set
, NULL
);
109 sig
= sigwaitinfo(&set
, NULL
);
113 { /* ignore signals we didn't wait for */
116 DBG1(DBG_DMN
, "waiting for signal failed: %s", strerror(errno
));
123 DBG1(DBG_DMN
, "signal of type SIGINT received. Shutting down");
124 charon
->bus
->alert(charon
->bus
, ALERT_SHUTDOWN_SIGNAL
, sig
);
129 DBG1(DBG_DMN
, "signal of type SIGTERM received. Shutting down");
130 charon
->bus
->alert(charon
->bus
, ALERT_SHUTDOWN_SIGNAL
, sig
);
138 * Handle SIGSEGV/SIGILL signals raised by threads
140 static void segv_handler(int signal
)
142 backtrace_t
*backtrace
;
144 DBG1(DBG_DMN
, "thread %u received %d", thread_current_id(), signal
);
145 backtrace
= backtrace_create(2);
146 backtrace
->log(backtrace
, stderr
, TRUE
);
147 backtrace
->destroy(backtrace
);
149 DBG1(DBG_DMN
, "killing ourself, received critical signal");
156 static bool lookup_uid_gid()
159 if (!lib
->caps
->resolve_uid(lib
->caps
, IPSEC_USER
))
165 if (!lib
->caps
->resolve_gid(lib
->caps
, IPSEC_GROUP
))
174 * Check/create PID file, return TRUE if already running
176 static bool check_pidfile()
180 if (stat(pidfile_name
, &stb
) == 0)
182 pidfile
= fopen(pidfile_name
, "r");
188 memset(buf
, 0, sizeof(buf
));
189 if (fread(buf
, 1, sizeof(buf
), pidfile
))
191 buf
[sizeof(buf
) - 1] = '\0';
196 if (pid
&& kill(pid
, 0) == 0)
198 DBG1(DBG_DMN
, "%s already running ('%s' exists)", dmn_name
,
203 DBG1(DBG_DMN
, "removing pidfile '%s', process not running", pidfile_name
);
204 unlink(pidfile_name
);
207 /* create new pidfile */
208 pidfile
= fopen(pidfile_name
, "w");
213 fd
= fileno(pidfile
);
214 if (fd
== -1 || fcntl(fd
, F_SETFD
, FD_CLOEXEC
) == -1)
216 DBG1(DBG_LIB
, "setting FD_CLOEXEC for '%s' failed: %s",
217 pidfile_name
, strerror(errno
));
219 ignore_result(fchown(fd
,
220 lib
->caps
->get_uid(lib
->caps
),
221 lib
->caps
->get_gid(lib
->caps
)));
222 fprintf(pidfile
, "%d\n", getpid());
228 DBG1(DBG_DMN
, "unable to create pidfile '%s'", pidfile_name
);
234 * Delete/truncate the PID file
236 static void unlink_pidfile()
238 /* because unlinking the PID file may fail, we truncate it to ensure the
239 * daemon can be properly restarted. one probable cause for this is the
240 * combination of not running as root and the effective user lacking
241 * permissions on the parent dir(s) of the PID file */
244 ignore_result(ftruncate(fileno(pidfile
), 0));
246 unlink(pidfile_name
);
251 * Main function, starts TKM backend.
253 int main(int argc
, char *argv
[])
255 if (argc
> 0 && strlen(argv
[0]) > 0)
257 dmn_name
= basename(argv
[0]);
261 dmn_name
= "charon-tkm";
264 /* TKM credential set */
267 struct sigaction action
;
268 int status
= SS_RC_INITIALIZATION_FAILED
;
270 /* logging for library during initialization, as we have no bus yet */
273 /* initialize library */
274 if (!library_init(NULL
, dmn_name
))
280 if (!libcharon_init())
282 dbg_syslog(DBG_DMN
, 1, "initialization failed - aborting %s", dmn_name
);
286 if (!lookup_uid_gid())
288 dbg_syslog(DBG_DMN
, 1, "invalid uid/gid - aborting %s", dmn_name
);
292 /* the authorize hook currently does not support RFC 7427 signature auth */
293 lib
->settings
->set_bool(lib
->settings
, "%s.signature_authentication", FALSE
,
296 /* make sure we log to the DAEMON facility by default */
297 lib
->settings
->set_int(lib
->settings
, "%s.syslog.daemon.default",
298 lib
->settings
->get_int(lib
->settings
, "%s.syslog.daemon.default", 1,
299 dmn_name
), dmn_name
);
300 charon
->load_loggers(charon
);
302 DBG1(DBG_DMN
, "Starting charon with TKM backend (strongSwan "VERSION
")");
304 /* register TKM specific plugins */
305 static plugin_feature_t features
[] = {
306 PLUGIN_REGISTER(NONCE_GEN
, tkm_nonceg_create
),
307 PLUGIN_PROVIDE(NONCE_GEN
),
308 PLUGIN_REGISTER(PUBKEY
, tkm_public_key_load
, TRUE
),
309 PLUGIN_PROVIDE(PUBKEY
, KEY_RSA
),
310 PLUGIN_PROVIDE(PUBKEY_VERIFY
, SIGN_RSA_EMSA_PKCS1_SHA1
),
311 PLUGIN_PROVIDE(PUBKEY_VERIFY
, SIGN_RSA_EMSA_PKCS1_SHA2_256
),
312 PLUGIN_CALLBACK(kernel_ipsec_register
, tkm_kernel_ipsec_create
),
313 PLUGIN_PROVIDE(CUSTOM
, "kernel-ipsec"),
314 PLUGIN_CALLBACK(tkm_spi_generator_register
, NULL
),
315 PLUGIN_PROVIDE(CUSTOM
, "tkm-spi-generator"),
316 PLUGIN_DEPENDS(CUSTOM
, "libcharon-sa-managers"),
318 lib
->plugins
->add_static_features(lib
->plugins
, "tkm-backend", features
,
319 countof(features
), TRUE
, NULL
, NULL
);
321 if (!register_dh_mapping())
323 DBG1(DBG_DMN
, "no DH group mapping defined - aborting %s", dmn_name
);
327 /* register TKM keymat variant */
328 keymat_register_constructor(IKEV2
, (keymat_constructor_t
)tkm_keymat_create
);
330 /* initialize daemon */
331 if (!charon
->initialize(charon
, PLUGINS
))
333 DBG1(DBG_DMN
, "initialization failed - aborting %s", dmn_name
);
336 lib
->plugins
->status(lib
->plugins
, LEVEL_CTRL
);
338 /* set global pidfile name depending on daemon name */
339 if (asprintf(&pidfile_name
, IPSEC_PIDDIR
"/%s.pid", dmn_name
) < 0)
341 DBG1(DBG_DMN
, "unable to set pidfile name - aborting %s", dmn_name
);
350 if (!lib
->caps
->drop(lib
->caps
))
352 DBG1(DBG_DMN
, "capability dropping failed - aborting %s", dmn_name
);
356 /* initialize TKM client */
359 DBG1(DBG_DMN
, "init of TKM client failed - aborting %s", dmn_name
);
363 /* register TKM authorization hook */
364 listener
= tkm_listener_create();
365 charon
->bus
->add_listener(charon
->bus
, &listener
->listener
);
367 /* register TKM credential set */
368 creds
= tkm_cred_create();
369 lib
->credmgr
->add_set(lib
->credmgr
, (credential_set_t
*)creds
);
371 /* register TKM credential encoder */
372 lib
->encoding
->add_encoder(lib
->encoding
, tkm_encoder_encode
);
374 /* add handler for SEGV and ILL,
375 * INT and TERM are handled by sigwaitinfo() in run() */
376 action
.sa_handler
= segv_handler
;
378 sigemptyset(&action
.sa_mask
);
379 sigaddset(&action
.sa_mask
, SIGINT
);
380 sigaddset(&action
.sa_mask
, SIGTERM
);
381 sigaction(SIGSEGV
, &action
, NULL
);
382 sigaction(SIGILL
, &action
, NULL
);
383 sigaction(SIGBUS
, &action
, NULL
);
384 action
.sa_handler
= SIG_IGN
;
385 sigaction(SIGPIPE
, &action
, NULL
);
387 pthread_sigmask(SIG_SETMASK
, &action
.sa_mask
, NULL
);
389 /* start daemon (i.e. the threads in the thread-pool) */
390 charon
->start(charon
);
392 /* main thread goes to run loop */
396 charon
->bus
->remove_listener(charon
->bus
, &listener
->listener
);
397 listener
->destroy(listener
);
398 creds
->destroy(creds
);
399 lib
->encoding
->remove_encoder(lib
->encoding
, tkm_encoder_encode
);
402 destroy_dh_mapping();