2 * Copyright (C) 2006-2017 Tobias Brunner
3 * Copyright (C) 2005-2009 Martin Willi
4 * Copyright (C) 2006 Daniel Roethlisberger
5 * Copyright (C) 2005 Jan Hutter
6 * HSR Hochschule fuer Technik Rapperswil
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
23 #include <sys/types.h>
24 #include <sys/utsname.h>
33 #include <utils/backtrace.h>
34 #include <threading/thread.h>
37 #include <private/android_filesystem_config.h> /* for AID_VPN */
41 * PID file, in which charon stores its process id
43 #define PID_FILE IPSEC_PIDDIR "/charon.pid"
46 * Default user and group
49 #define IPSEC_USER NULL
53 #define IPSEC_GROUP NULL
57 * Global reference to PID file (required to truncate, if undeletable)
59 static FILE *pidfile
= NULL
;
62 * hook in library for debugging messages
64 extern void (*dbg
) (debug_t group
, level_t level
, char *fmt
, ...);
67 * Logging hook for library logs, using stderr output
69 static void dbg_stderr(debug_t group
, level_t level
, char *fmt
, ...)
76 fprintf(stderr
, "00[%N] ", debug_names
, group
);
77 vfprintf(stderr
, fmt
, args
);
78 fprintf(stderr
, "\n");
84 * Run the daemon and handle unix signals
90 /* handle SIGINT, SIGHUP and SIGTERM in this handler */
92 sigaddset(&set
, SIGINT
);
93 sigaddset(&set
, SIGHUP
);
94 sigaddset(&set
, SIGTERM
);
95 sigprocmask(SIG_BLOCK
, &set
, NULL
);
101 sig
= sigwaitinfo(&set
, NULL
);
105 { /* ignore signals we didn't wait for */
108 DBG1(DBG_DMN
, "waiting for signal failed: %s", strerror(errno
));
115 DBG1(DBG_DMN
, "signal of type SIGHUP received. Reloading "
117 if (lib
->settings
->load_files(lib
->settings
, lib
->conf
, FALSE
))
119 charon
->load_loggers(charon
);
120 lib
->plugins
->reload(lib
->plugins
, NULL
);
124 DBG1(DBG_DMN
, "reloading config failed, keeping old");
130 DBG1(DBG_DMN
, "signal of type SIGINT received. Shutting down");
131 charon
->bus
->alert(charon
->bus
, ALERT_SHUTDOWN_SIGNAL
, sig
);
136 DBG1(DBG_DMN
, "signal of type SIGTERM received. Shutting down");
137 charon
->bus
->alert(charon
->bus
, ALERT_SHUTDOWN_SIGNAL
, sig
);
147 static bool lookup_uid_gid()
151 name
= lib
->settings
->get_str(lib
->settings
, "charon.user", IPSEC_USER
);
152 if (name
&& !lib
->caps
->resolve_uid(lib
->caps
, name
))
156 name
= lib
->settings
->get_str(lib
->settings
, "charon.group", IPSEC_GROUP
);
157 if (name
&& !lib
->caps
->resolve_gid(lib
->caps
, name
))
162 lib
->caps
->set_uid(lib
->caps
, AID_VPN
);
168 * Handle SIGSEGV/SIGILL signals raised by threads
170 static void segv_handler(int signal
)
172 backtrace_t
*backtrace
;
174 DBG1(DBG_DMN
, "thread %u received %d", thread_current_id(), signal
);
175 backtrace
= backtrace_create(2);
176 backtrace
->log(backtrace
, NULL
, TRUE
);
177 backtrace
->log(backtrace
, stderr
, TRUE
);
178 backtrace
->destroy(backtrace
);
180 DBG1(DBG_DMN
, "killing ourself, received critical signal");
185 * Check/create PID file, return TRUE if already running
187 static bool check_pidfile()
191 if (stat(PID_FILE
, &stb
) == 0)
193 pidfile
= fopen(PID_FILE
, "r");
199 memset(buf
, 0, sizeof(buf
));
200 if (fread(buf
, 1, sizeof(buf
), pidfile
))
202 buf
[sizeof(buf
) - 1] = '\0';
207 if (pid
&& pid
!= getpid() && kill(pid
, 0) == 0)
209 DBG1(DBG_DMN
, "charon already running ('"PID_FILE
"' exists)");
213 DBG1(DBG_DMN
, "removing pidfile '"PID_FILE
"', process not running");
217 /* create new pidfile */
218 pidfile
= fopen(PID_FILE
, "w");
223 fd
= fileno(pidfile
);
226 DBG1(DBG_DMN
, "unable to determine fd for '"PID_FILE
"'");
229 if (fcntl(fd
, F_SETFD
, FD_CLOEXEC
) == -1)
231 DBG1(DBG_LIB
, "setting FD_CLOEXEC for '"PID_FILE
"' failed: %s",
234 /* Only fchown() the pidfile if we have CAP_CHOWN. Otherwise,
235 * directory permissions should allow pidfile to be accessed
236 * by the UID/GID under which the charon deamon will run. */
237 if (lib
->caps
->check(lib
->caps
, CAP_CHOWN
))
239 ignore_result(fchown(fd
,
240 lib
->caps
->get_uid(lib
->caps
),
241 lib
->caps
->get_gid(lib
->caps
)));
243 fprintf(pidfile
, "%d\n", getpid());
249 DBG1(DBG_DMN
, "unable to create pidfile '"PID_FILE
"'");
255 * Delete/truncate the PID file
257 static void unlink_pidfile()
259 /* because unlinking the PID file may fail, we truncate it to ensure the
260 * daemon can be properly restarted. one probable cause for this is the
261 * combination of not running as root and the effective user lacking
262 * permissions on the parent dir(s) of the PID file */
265 ignore_result(ftruncate(fileno(pidfile
), 0));
272 * print command line usage and exit
274 static void usage(const char *msg
)
276 if (msg
!= NULL
&& *msg
!= '\0')
278 fprintf(stderr
, "%s\n", msg
);
280 fprintf(stderr
, "Usage: charon\n"
284 " [--debug-<type> <level>]\n"
285 " <type>: log context type (dmn|mgr|ike|chd|job|cfg|knl|net|asn|enc|tnc|imc|imv|pts|tls|esp|lib)\n"
286 " <level>: log verbosity (-1 = silent, 0 = audit, 1 = control,\n"
287 " 2 = controlmore, 3 = raw, 4 = private)\n"
293 * Main function, starts the daemon.
295 int main(int argc
, char *argv
[])
297 struct sigaction action
;
298 int group
, status
= SS_RC_INITIALIZATION_FAILED
;
299 struct utsname utsname
;
300 level_t levels
[DBG_MAX
];
301 bool use_syslog
= FALSE
;
303 /* logging for library during initialization, as we have no bus yet */
306 /* initialize library */
307 if (!library_init(NULL
, "charon"))
310 exit(SS_RC_LIBSTRONGSWAN_INTEGRITY
);
313 if (lib
->integrity
&&
314 !lib
->integrity
->check_file(lib
->integrity
, "charon", argv
[0]))
316 dbg_stderr(DBG_DMN
, 1, "integrity check of charon failed");
318 exit(SS_RC_DAEMON_INTEGRITY
);
321 if (!libcharon_init())
323 dbg_stderr(DBG_DMN
, 1, "initialization failed - aborting charon");
327 /* use CTRL loglevel for default */
328 for (group
= 0; group
< DBG_MAX
; group
++)
330 levels
[group
] = LEVEL_CTRL
;
333 /* handle arguments */
336 struct option long_opts
[] = {
337 { "help", no_argument
, NULL
, 'h' },
338 { "version", no_argument
, NULL
, 'v' },
339 { "use-syslog", no_argument
, NULL
, 'l' },
340 /* TODO: handle "debug-all" */
341 { "debug-dmn", required_argument
, &group
, DBG_DMN
},
342 { "debug-mgr", required_argument
, &group
, DBG_MGR
},
343 { "debug-ike", required_argument
, &group
, DBG_IKE
},
344 { "debug-chd", required_argument
, &group
, DBG_CHD
},
345 { "debug-job", required_argument
, &group
, DBG_JOB
},
346 { "debug-cfg", required_argument
, &group
, DBG_CFG
},
347 { "debug-knl", required_argument
, &group
, DBG_KNL
},
348 { "debug-net", required_argument
, &group
, DBG_NET
},
349 { "debug-asn", required_argument
, &group
, DBG_ASN
},
350 { "debug-enc", required_argument
, &group
, DBG_ENC
},
351 { "debug-tnc", required_argument
, &group
, DBG_TNC
},
352 { "debug-imc", required_argument
, &group
, DBG_IMC
},
353 { "debug-imv", required_argument
, &group
, DBG_IMV
},
354 { "debug-pts", required_argument
, &group
, DBG_PTS
},
355 { "debug-tls", required_argument
, &group
, DBG_TLS
},
356 { "debug-esp", required_argument
, &group
, DBG_ESP
},
357 { "debug-lib", required_argument
, &group
, DBG_LIB
},
361 int c
= getopt_long(argc
, argv
, "", long_opts
, NULL
);
371 printf("Linux strongSwan %s\n", VERSION
);
378 /* option is in group */
379 levels
[group
] = atoi(optarg
);
389 if (!lookup_uid_gid())
391 dbg_stderr(DBG_DMN
, 1, "invalid uid/gid - aborting charon");
395 charon
->set_default_loggers(charon
, levels
, !use_syslog
);
396 charon
->load_loggers(charon
);
398 if (uname(&utsname
) != 0)
400 memset(&utsname
, 0, sizeof(utsname
));
402 DBG1(DBG_DMN
, "Starting IKE charon daemon (strongSwan "VERSION
", %s %s, %s)",
403 utsname
.sysname
, utsname
.release
, utsname
.machine
);
406 DBG1(DBG_DMN
, "integrity tests enabled:");
407 DBG1(DBG_DMN
, "lib 'libstrongswan': passed file and segment integrity tests");
408 DBG1(DBG_DMN
, "lib 'libcharon': passed file and segment integrity tests");
409 DBG1(DBG_DMN
, "daemon 'charon': passed file integrity test");
412 /* initialize daemon */
413 if (!charon
->initialize(charon
,
414 lib
->settings
->get_str(lib
->settings
, "charon.load", PLUGINS
)))
416 DBG1(DBG_DMN
, "initialization failed - aborting charon");
419 lib
->plugins
->status(lib
->plugins
, LEVEL_CTRL
);
426 if (!lib
->caps
->drop(lib
->caps
))
428 DBG1(DBG_DMN
, "capability dropping failed - aborting charon");
432 /* add handler for SEGV and ILL,
433 * INT, TERM and HUP are handled by sigwaitinfo() in run() */
434 action
.sa_handler
= segv_handler
;
436 sigemptyset(&action
.sa_mask
);
437 sigaddset(&action
.sa_mask
, SIGINT
);
438 sigaddset(&action
.sa_mask
, SIGTERM
);
439 sigaddset(&action
.sa_mask
, SIGHUP
);
440 sigaction(SIGSEGV
, &action
, NULL
);
441 sigaction(SIGILL
, &action
, NULL
);
442 sigaction(SIGBUS
, &action
, NULL
);
443 action
.sa_handler
= SIG_IGN
;
444 sigaction(SIGPIPE
, &action
, NULL
);
446 pthread_sigmask(SIG_SETMASK
, &action
.sa_mask
, NULL
);
448 /* start daemon (i.e. the threads in the thread-pool) */
449 charon
->start(charon
);
451 /* main thread goes to run loop */