2 * Copyright (C) 1997 Angelos D. Keromytis.
3 * Copyright (C) 1998-2001 D. Hugh Redelmeier.
4 * Copyright (C) 2009 Andreas Steffen - Hochschule fuer Technik Rapperswil
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
23 #include <sys/types.h>
29 #include <arpa/nameser.h> /* missing from <resolv.h> on old systems */
30 #include <sys/queue.h>
31 #include <sys/prctl.h>
36 #include <sys/capability.h>
37 #endif /* CAPABILITIES */
43 #include <utils/enumerator.h>
44 #include <utils/optionsfrom.h>
49 #include "constants.h"
55 #include "connections.h"
56 #include "foodgroups.h"
58 #include "demux.h" /* needs packet.h */
63 #include "adns.h" /* needs <resolv.h> */
64 #include "dnskey.h" /* needs keys.h and adns.h */
66 #include "ipsec_doi.h" /* needs demux.h and state.h */
72 #include "nat_traversal.h"
77 static void usage(const char *mess
)
79 if (mess
!= NULL
&& *mess
!= '\0')
80 fprintf(stderr
, "%s\n", mess
);
85 " [--optionsfrom <filename>]"
93 " [--crlcheckinterval <interval>]"
97 "[--interface <ifname>]"
98 " [--ikeport <port-number>]"
102 "[--perpeerlogbase <path>] [--perpeerlog]"
104 "[--secretsfile <secrets-file>]"
105 " [--policygroupsdir <policygroups-dir>]"
107 "[--adns <pathname>]"
108 "[--pkcs11module <path>]"
109 "[--pkcs11keepstate]"
110 "[--pkcs11initargs <string>]"
119 " [--debug-emitting]"
122 " [--debug-lifecycle]"
127 " [--debug-controlmore]"
132 "[--nat_traversal] [--keep_alive <delay_sec>]"
134 "[--force_keepalive] [--disable_port_floating]"
136 "[--virtual_private <network_list>]"
138 "strongSwan "VERSION
"\n");
139 exit_pluto(mess
== NULL
? 0 : 1);
144 * - provides convenient way for scripts to find Pluto's pid
145 * - prevents multiple Plutos competing for the same port
146 * - same basename as unix domain control socket
147 * NOTE: will not take account of sharing LOCK_DIR with other systems.
150 static char pluto_lock
[sizeof(ctl_addr
.sun_path
)] = DEFAULT_CTLBASE LOCK_SUFFIX
;
151 static bool pluto_lock_created
= FALSE
;
153 /* create lockfile, or die in the attempt */
154 static int create_lock(void)
156 int fd
= open(pluto_lock
, O_WRONLY
| O_CREAT
| O_EXCL
| O_TRUNC
157 , S_IRUSR
| S_IRGRP
| S_IROTH
);
163 fprintf(stderr
, "pluto: lock file \"%s\" already exists\n"
170 , "pluto: unable to create lock file \"%s\" (%d %s)\n"
171 , pluto_lock
, errno
, strerror(errno
));
175 pluto_lock_created
= TRUE
;
179 static bool fill_lock(int lockfd
, pid_t pid
)
181 char buf
[30]; /* holds "<pid>\n" */
182 int len
= snprintf(buf
, sizeof(buf
), "%u\n", (unsigned int) pid
);
183 bool ok
= len
> 0 && write(lockfd
, buf
, len
) == len
;
189 static void delete_lock(void)
191 if (pluto_lock_created
)
194 unlink(pluto_lock
); /* is noting failure useful? */
199 /* by default pluto sends certificate requests to its peers */
200 bool no_cr_send
= FALSE
;
202 /* by default the CRL policy is lenient */
203 bool strict_crl_policy
= FALSE
;
205 /* by default CRLs are cached locally as files */
206 bool cache_crls
= FALSE
;
208 /* by default pluto does not check crls dynamically */
209 long crl_check_interval
= 0;
211 /* path to the PKCS#11 module */
212 char *pkcs11_module_path
= NULL
;
214 /* by default pluto logs out after every smartcard use */
215 bool pkcs11_keep_state
= FALSE
;
217 /* by default pluto does not allow pkcs11 proxy access via whack */
218 bool pkcs11_proxy
= FALSE
;
220 /* argument string to pass to PKCS#11 module.
221 * Not used for compliant modules, just for NSS softoken
223 static const char *pkcs11_init_args
= NULL
;
225 /* options read by optionsfrom */
231 static void print_plugins()
233 char buf
[BUF_LEN
], *plugin
;
235 enumerator_t
*enumerator
;
238 enumerator
= lib
->plugins
->create_plugin_enumerator(lib
->plugins
);
239 while (len
< BUF_LEN
&& enumerator
->enumerate(enumerator
, &plugin
))
241 len
+= snprintf(&buf
[len
], BUF_LEN
-len
, "%s ", plugin
);
243 enumerator
->destroy(enumerator
);
244 DBG1("loaded plugins: %s", buf
);
247 int main(int argc
, char **argv
)
249 bool fork_desired
= TRUE
;
250 bool log_to_stderr_desired
= FALSE
;
251 bool nat_traversal
= FALSE
;
252 bool nat_t_spf
= TRUE
; /* support port floating */
253 unsigned int keep_alive
= 0;
254 bool force_keepalive
= FALSE
;
255 char *virtual_private
= NULL
;
259 int keep
[] = { CAP_NET_ADMIN
, CAP_NET_BIND_SERVICE
};
260 #endif /* CAPABILITIES */
262 /* initialize library and optionsfrom */
263 if (!library_init(STRONGSWAN_CONF
))
267 options
= options_create();
269 /* handle arguments */
272 # define DBG_OFFSET 256
273 static const struct option long_opts
[] = {
274 /* name, has_arg, flag, val */
275 { "help", no_argument
, NULL
, 'h' },
276 { "version", no_argument
, NULL
, 'v' },
277 { "optionsfrom", required_argument
, NULL
, '+' },
278 { "nofork", no_argument
, NULL
, 'd' },
279 { "stderrlog", no_argument
, NULL
, 'e' },
280 { "noklips", no_argument
, NULL
, 'n' },
281 { "nocrsend", no_argument
, NULL
, 'c' },
282 { "strictcrlpolicy", no_argument
, NULL
, 'r' },
283 { "crlcheckinterval", required_argument
, NULL
, 'x'},
284 { "cachecrls", no_argument
, NULL
, 'C' },
285 { "uniqueids", no_argument
, NULL
, 'u' },
286 { "interface", required_argument
, NULL
, 'i' },
287 { "ikeport", required_argument
, NULL
, 'p' },
288 { "ctlbase", required_argument
, NULL
, 'b' },
289 { "secretsfile", required_argument
, NULL
, 's' },
290 { "foodgroupsdir", required_argument
, NULL
, 'f' },
291 { "perpeerlogbase", required_argument
, NULL
, 'P' },
292 { "perpeerlog", no_argument
, NULL
, 'l' },
293 { "policygroupsdir", required_argument
, NULL
, 'f' },
295 { "lwdnsq", required_argument
, NULL
, 'a' },
296 #else /* !USE_LWRES */
297 { "adns", required_argument
, NULL
, 'a' },
298 #endif /* !USE_LWRES */
299 { "pkcs11module", required_argument
, NULL
, 'm' },
300 { "pkcs11keepstate", no_argument
, NULL
, 'k' },
301 { "pkcs11initargs", required_argument
, NULL
, 'z' },
302 { "pkcs11proxy", no_argument
, NULL
, 'y' },
303 { "nat_traversal", no_argument
, NULL
, '1' },
304 { "keep_alive", required_argument
, NULL
, '2' },
305 { "force_keepalive", no_argument
, NULL
, '3' },
306 { "disable_port_floating", no_argument
, NULL
, '4' },
307 { "debug-natt", no_argument
, NULL
, '5' },
308 { "virtual_private", required_argument
, NULL
, '6' },
310 { "debug-none", no_argument
, NULL
, 'N' },
311 { "debug-all", no_argument
, NULL
, 'A' },
312 { "debug-raw", no_argument
, NULL
, DBG_RAW
+ DBG_OFFSET
},
313 { "debug-crypt", no_argument
, NULL
, DBG_CRYPT
+ DBG_OFFSET
},
314 { "debug-parsing", no_argument
, NULL
, DBG_PARSING
+ DBG_OFFSET
},
315 { "debug-emitting", no_argument
, NULL
, DBG_EMITTING
+ DBG_OFFSET
},
316 { "debug-control", no_argument
, NULL
, DBG_CONTROL
+ DBG_OFFSET
},
317 { "debug-lifecycle", no_argument
, NULL
, DBG_LIFECYCLE
+ DBG_OFFSET
},
318 { "debug-klips", no_argument
, NULL
, DBG_KLIPS
+ DBG_OFFSET
},
319 { "debug-dns", no_argument
, NULL
, DBG_DNS
+ DBG_OFFSET
},
320 { "debug-oppo", no_argument
, NULL
, DBG_OPPO
+ DBG_OFFSET
},
321 { "debug-controlmore", no_argument
, NULL
, DBG_CONTROLMORE
+ DBG_OFFSET
},
322 { "debug-private", no_argument
, NULL
, DBG_PRIVATE
+ DBG_OFFSET
},
324 { "impair-delay-adns-key-answer", no_argument
, NULL
, IMPAIR_DELAY_ADNS_KEY_ANSWER
+ DBG_OFFSET
},
325 { "impair-delay-adns-txt-answer", no_argument
, NULL
, IMPAIR_DELAY_ADNS_TXT_ANSWER
+ DBG_OFFSET
},
326 { "impair-bust-mi2", no_argument
, NULL
, IMPAIR_BUST_MI2
+ DBG_OFFSET
},
327 { "impair-bust-mr2", no_argument
, NULL
, IMPAIR_BUST_MR2
+ DBG_OFFSET
},
331 /* Note: we don't like the way short options get parsed
332 * by getopt_long, so we simply pass an empty string as
333 * the list. It could be "hvdenp:l:s:" "NARXPECK".
335 int c
= getopt_long(argc
, argv
, "", long_opts
, NULL
);
337 /* Note: "breaking" from case terminates loop */
340 case EOF
: /* end of flags */
343 case 0: /* long option already handled */
346 case ':': /* diagnostic already printed by getopt_long */
347 case '?': /* diagnostic already printed by getopt_long */
349 break; /* not actually reached */
351 case 'h': /* --help */
353 break; /* not actually reached */
355 case 'v': /* --version */
357 const char **sp
= ipsec_copyright_notice();
359 printf("strongSwan "VERSION
"%s\n", compile_time_interop_options
);
360 for (; *sp
!= NULL
; sp
++)
364 break; /* not actually reached */
366 case '+': /* --optionsfrom <filename> */
367 if (!options
->from(options
, optarg
, &argc
, &argv
, optind
))
373 case 'd': /* --nofork*/
374 fork_desired
= FALSE
;
377 case 'e': /* --stderrlog */
378 log_to_stderr_desired
= TRUE
;
381 case 'n': /* --noklips */
385 case 'c': /* --nocrsend */
389 case 'r': /* --strictcrlpolicy */
390 strict_crl_policy
= TRUE
;
393 case 'x': /* --crlcheckinterval <time>*/
394 if (optarg
== NULL
|| !isdigit(optarg
[0]))
395 usage("missing interval time");
399 long interval
= strtol(optarg
, &endptr
, 0);
401 if (*endptr
!= '\0' || endptr
== optarg
403 usage("<interval-time> must be a positive number");
404 crl_check_interval
= interval
;
408 case 'C': /* --cachecrls */
412 case 'u': /* --uniqueids */
416 case 'i': /* --interface <ifname> */
417 if (!use_interface(optarg
))
418 usage("too many --interface specifications");
421 case 'p': /* --port <portnumber> */
422 if (optarg
== NULL
|| !isdigit(optarg
[0]))
423 usage("missing port number");
427 long port
= strtol(optarg
, &endptr
, 0);
429 if (*endptr
!= '\0' || endptr
== optarg
430 || port
<= 0 || port
> 0x10000)
431 usage("<port-number> must be a number between 1 and 65535");
436 case 'b': /* --ctlbase <path> */
437 if (snprintf(ctl_addr
.sun_path
, sizeof(ctl_addr
.sun_path
)
438 , "%s%s", optarg
, CTL_SUFFIX
) == -1)
439 usage("<path>" CTL_SUFFIX
" too long for sun_path");
440 if (snprintf(info_addr
.sun_path
, sizeof(info_addr
.sun_path
)
441 , "%s%s", optarg
, INFO_SUFFIX
) == -1)
442 usage("<path>" INFO_SUFFIX
" too long for sun_path");
443 if (snprintf(pluto_lock
, sizeof(pluto_lock
)
444 , "%s%s", optarg
, LOCK_SUFFIX
) == -1)
445 usage("<path>" LOCK_SUFFIX
" must fit");
448 case 's': /* --secretsfile <secrets-file> */
449 shared_secrets_file
= optarg
;
452 case 'f': /* --policygroupsdir <policygroups-dir> */
453 policygroups_dir
= optarg
;
456 case 'a': /* --adns <pathname> */
457 pluto_adns_option
= optarg
;
460 case 'm': /* --pkcs11module <pathname> */
461 pkcs11_module_path
= optarg
;
464 case 'k': /* --pkcs11keepstate */
465 pkcs11_keep_state
= TRUE
;
468 case 'y': /* --pkcs11proxy */
472 case 'z': /* --pkcs11initargs */
473 pkcs11_init_args
= optarg
;
477 case 'N': /* --debug-none */
478 base_debugging
= DBG_NONE
;
481 case 'A': /* --debug-all */
482 base_debugging
= DBG_ALL
;
486 case 'P': /* --perpeerlogbase */
487 base_perpeer_logdir
= optarg
;
491 log_to_perpeer
= TRUE
;
494 case '1': /* --nat_traversal */
495 nat_traversal
= TRUE
;
497 case '2': /* --keep_alive */
498 keep_alive
= atoi(optarg
);
500 case '3': /* --force_keepalive */
501 force_keepalive
= TRUE
;
503 case '4': /* --disable_port_floating */
506 case '5': /* --debug-nat_t */
507 base_debugging
|= DBG_NATT
;
509 case '6': /* --virtual_private */
510 virtual_private
= optarg
;
517 base_debugging
|= c
- DBG_OFFSET
;
527 usage("unexpected argument");
529 lockfd
= create_lock();
531 /* select between logging methods */
533 if (log_to_stderr_desired
)
535 log_to_syslog
= FALSE
;
539 log_to_stderr
= FALSE
;
542 /* set the logging function of pfkey debugging */
544 pfkey_debug_func
= DBG_log
;
546 pfkey_debug_func
= NULL
;
549 /* create control socket.
550 * We must create it before the parent process returns so that
551 * there will be no race condition in using it. The easiest
552 * place to do this is before the daemon fork.
555 err_t ugh
= init_ctl_socket();
559 fprintf(stderr
, "pluto: %s", ugh
);
564 /* If not suppressed, do daemon fork */
575 fprintf(stderr
, "pluto: fork failed (%d %s)\n",
582 /* parent: die, after filling PID into lock file.
583 * must not use exit_pluto: lock would be removed!
585 exit(fill_lock(lockfd
, pid
)? 0 : 1);
593 fprintf(stderr
, "setsid() failed in main(). Errno %d: %s\n",
600 /* no daemon fork: we have to fill in lock file */
601 (void) fill_lock(lockfd
, getpid());
602 fprintf(stdout
, "Pluto initialized\n");
606 /* Close everything but ctl_fd and (if needed) stderr.
607 * There is some danger that a library that we don't know
608 * about is using some fd that we don't know about.
609 * I guess we'll soon find out.
614 for (i
= getdtablesize() - 1; i
>= 0; i
--) /* Bad hack */
616 if ((!log_to_stderr
|| i
!= 2) && i
!= ctl_fd
)
620 /* make sure that stdin, stdout, stderr are reserved */
621 if (open("/dev/null", O_RDONLY
) != 0)
625 if (!log_to_stderr
&& dup2(0, 2) != 2)
632 /* Note: some scripts may look for this exact message -- don't change
633 * ipsec barf was one, but it no longer does.
635 plog("Starting IKEv1 pluto daemon (strongSwan "VERSION
")%s",
636 compile_time_interop_options
);
638 /* load plugins, further infrastructure may need it */
639 lib
->plugins
->load(lib
->plugins
, IPSEC_PLUGINDIR
,
640 lib
->settings
->get_str(lib
->settings
, "pluto.load", PLUGINS
));
643 init_nat_traversal(nat_traversal
, keep_alive
, force_keepalive
, nat_t_spf
);
644 init_virtual_ip(virtual_private
);
645 scx_init(pkcs11_module_path
, pkcs11_init_args
);
656 /* drop unneeded capabilities and change UID/GID */
657 prctl(PR_SET_KEEPCAPS
, 1);
661 struct group group
, *grp
;
664 if (getgrnam_r(IPSEC_GROUP
, &group
, buf
, sizeof(buf
), &grp
) != 0 ||
665 grp
== NULL
|| setgid(grp
->gr_gid
) != 0)
667 plog("unable to change daemon group");
674 struct passwd passwd
, *pwp
;
677 if (getpwnam_r(IPSEC_USER
, &passwd
, buf
, sizeof(buf
), &pwp
) != 0 ||
678 pwp
== NULL
|| setuid(pwp
->pw_uid
) != 0)
680 plog("unable to change daemon user");
688 cap_set_flag(caps
, CAP_EFFECTIVE
, 2, keep
, CAP_SET
);
689 cap_set_flag(caps
, CAP_INHERITABLE
, 2, keep
, CAP_SET
);
690 cap_set_flag(caps
, CAP_PERMITTED
, 2, keep
, CAP_SET
);
691 if (cap_set_proc(caps
) != 0)
693 plog("unable to drop daemon capabilities");
697 #endif /* CAPABILITIES */
699 /* loading X.509 CA certificates */
700 load_authcerts("CA cert", CA_CERT_PATH
, AUTH_CA
);
701 /* loading X.509 AA certificates */
702 load_authcerts("AA cert", AA_CERT_PATH
, AUTH_AA
);
703 /* loading X.509 OCSP certificates */
704 load_authcerts("OCSP cert", OCSP_CERT_PATH
, AUTH_OCSP
);
705 /* loading X.509 CRLs */
707 /* loading attribute certificates (experimental) */
712 return -1; /* Shouldn't ever reach this */
715 /* leave pluto, with status.
716 * Once child is launched, parent must not exit this way because
717 * the lock would be released.
720 * 1 general discomfort
721 * 10 lock file exists
723 void exit_pluto(int status
)
725 reset_globals(); /* needed because we may be called in odd state */
726 free_preshared_secrets();
727 free_remembered_public_keys();
728 delete_every_connection();
729 free_crl_fetch(); /* free chain of crl fetch requests */
730 free_ocsp_fetch(); /* free chain of ocsp fetch requests */
731 free_authcerts(); /* free chain of X.509 authority certificates */
732 free_crls(); /* free chain of X.509 CRLs */
733 free_acerts(); /* free chain of X.509 attribute certificates */
734 free_ca_infos(); /* free chain of X.509 CA information records */
735 free_ocsp(); /* free ocsp cache */
737 scx_finalize(); /* finalize and unload PKCS #11 module */
738 xauth_finalize(); /* finalize and unload XAUTH module */
742 free_id(); /* free myids */
743 free_events(); /* free remaining events */
744 free_vendorid(); /* free all vendor id records */
746 options
->destroy(options
);