denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Moved ha plugin to libcharon

Browse Source
This commit is contained in:
Martin Willi
2010-04-07 13:55:16 +02:00
parent 3e8caf6af6
commit 29a46aacad
22 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/plugins/ha/Makefile.am
-19
View File
@@ -1,19 +0,0 @@
INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic -DIPSEC_PIDDIR=\"${piddir}\"
plugin_LTLIBRARIES = libstrongswan-ha.la
libstrongswan_ha_la_SOURCES = \
ha_plugin.h ha_plugin.c \
ha_message.h ha_message.c \
ha_socket.h ha_socket.c \
ha_tunnel.h ha_tunnel.c \
ha_dispatcher.h ha_dispatcher.c \
ha_segments.h ha_segments.c \
ha_kernel.h ha_kernel.c \
ha_ctl.h ha_ctl.c \
ha_ike.h ha_ike.c \
ha_child.h ha_child.c
libstrongswan_ha_la_LDFLAGS = -module
src/charon/plugins/ha/ha_child.c
-170
View File
@@ -1,170 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ha_child.h"
typedef struct private_ha_child_t private_ha_child_t;
/**
* Private data of an ha_child_t object.
*/
struct private_ha_child_t {
/**
* Public ha_child_t interface.
*/
ha_child_t public;
/**
* socket we use for syncing
*/
ha_socket_t *socket;
/**
* tunnel securing sync messages
*/
ha_tunnel_t *tunnel;
};
/**
* Implementation of listener_t.child_keys
*/
static bool child_keys(private_ha_child_t *this, ike_sa_t *ike_sa,
child_sa_t *child_sa, diffie_hellman_t *dh,
chunk_t nonce_i, chunk_t nonce_r)
{
ha_message_t *m;
chunk_t secret;
proposal_t *proposal;
u_int16_t alg, len;
linked_list_t *list;
enumerator_t *enumerator;
traffic_selector_t *ts;
if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
{ /* do not sync SA between nodes */
return TRUE;
}
m = ha_message_create(HA_CHILD_ADD);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
m->add_attribute(m, HA_INBOUND_SPI, child_sa->get_spi(child_sa, TRUE));
m->add_attribute(m, HA_OUTBOUND_SPI, child_sa->get_spi(child_sa, FALSE));
m->add_attribute(m, HA_INBOUND_CPI, child_sa->get_cpi(child_sa, TRUE));
m->add_attribute(m, HA_OUTBOUND_CPI, child_sa->get_cpi(child_sa, FALSE));
m->add_attribute(m, HA_IPSEC_MODE, child_sa->get_mode(child_sa));
m->add_attribute(m, HA_IPCOMP, child_sa->get_ipcomp(child_sa));
m->add_attribute(m, HA_CONFIG_NAME, child_sa->get_name(child_sa));
proposal = child_sa->get_proposal(child_sa);
if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &len))
{
m->add_attribute(m, HA_ALG_ENCR, alg);
if (len)
{
m->add_attribute(m, HA_ALG_ENCR_LEN, len);
}
}
if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
{
m->add_attribute(m, HA_ALG_INTEG, alg);
}
m->add_attribute(m, HA_NONCE_I, nonce_i);
m->add_attribute(m, HA_NONCE_R, nonce_r);
if (dh && dh->get_shared_secret(dh, &secret) == SUCCESS)
{
m->add_attribute(m, HA_SECRET, secret);
chunk_clear(&secret);
}
list = child_sa->get_traffic_selectors(child_sa, TRUE);
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, &ts))
{
m->add_attribute(m, HA_LOCAL_TS, ts);
}
enumerator->destroy(enumerator);
list = child_sa->get_traffic_selectors(child_sa, FALSE);
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, &ts))
{
m->add_attribute(m, HA_REMOTE_TS, ts);
}
enumerator->destroy(enumerator);
this->socket->push(this->socket, m);
return TRUE;
}
/**
* Implementation of listener_t.child_state_change
*/
static bool child_state_change(private_ha_child_t *this, ike_sa_t *ike_sa,
child_sa_t *child_sa, child_sa_state_t state)
{
if (!ike_sa ||
ike_sa->get_state(ike_sa) == IKE_PASSIVE ||
ike_sa->get_state(ike_sa) == IKE_DESTROYING)
{ /* only sync active IKE_SAs */
return TRUE;
}
if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
{ /* do not sync SA between nodes */
return TRUE;
}
if (state == CHILD_DESTROYING)
{
ha_message_t *m;
m = ha_message_create(HA_CHILD_DELETE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
m->add_attribute(m, HA_INBOUND_SPI,
child_sa->get_spi(child_sa, TRUE));
this->socket->push(this->socket, m);
}
return TRUE;
}
/**
* Implementation of ha_child_t.destroy.
*/
static void destroy(private_ha_child_t *this)
{
free(this);
}
/**
* See header
*/
ha_child_t *ha_child_create(ha_socket_t *socket, ha_tunnel_t *tunnel)
{
private_ha_child_t *this = malloc_thing(private_ha_child_t);
memset(&this->public.listener, 0, sizeof(listener_t));
this->public.listener.child_keys = (bool(*)(listener_t*, ike_sa_t *ike_sa, child_sa_t *child_sa, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r))child_keys;
this->public.listener.child_state_change = (bool(*)(listener_t*,ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state))child_state_change;
this->public.destroy = (void(*)(ha_child_t*))destroy;
this->socket = socket;
this->tunnel = tunnel;
return &this->public;
}
src/charon/plugins/ha/ha_child.h
-57
View File
@@ -1,57 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha_child ha_child
* @{ @ingroup ha
*/
#ifndef HA_CHILD_H_
#define HA_CHILD_H_
#include "ha_socket.h"
#include "ha_tunnel.h"
#include "ha_segments.h"
#include <daemon.h>
typedef struct ha_child_t ha_child_t;
/**
* Listener to synchronize CHILD_SAs.
*/
struct ha_child_t {
/**
* Implements bus listener interface.
*/
listener_t listener;
/**
* Destroy a ha_child_t.
*/
void (*destroy)(ha_child_t *this);
};
/**
* Create a ha_child instance.
*
* @param socket socket to use for sending synchronization messages
* @param tunnel tunnel securing sync messages, if any
* @return CHILD listener
*/
ha_child_t *ha_child_create(ha_socket_t *socket, ha_tunnel_t *tunnel);
#endif /* HA_CHILD_ @}*/
src/charon/plugins/ha/ha_ctl.c
-132
View File
@@ -1,132 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ha_ctl.h"
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/select.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <pthread.h>
#include <processing/jobs/callback_job.h>
#define HA_FIFO IPSEC_PIDDIR "/charon.ha"
typedef struct private_ha_ctl_t private_ha_ctl_t;
/**
* Private data of an ha_ctl_t object.
*/
struct private_ha_ctl_t {
/**
* Public ha_ctl_t interface.
*/
ha_ctl_t public;
/**
* Segments to control
*/
ha_segments_t *segments;
/**
* FIFO reader thread
*/
callback_job_t *job;
};
/**
* FIFO dispatching function
*/
static job_requeue_t dispatch_fifo(private_ha_ctl_t *this)
{
int fifo, old;
char buf[8];
u_int segment;
pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &old);
fifo = open(HA_FIFO, O_RDONLY);
pthread_setcancelstate(old, NULL);
if (fifo == -1)
{
DBG1(DBG_CFG, "opening HA fifo failed: %s", strerror(errno));
sleep(1);
return JOB_REQUEUE_FAIR;
}
memset(buf, 0, sizeof(buf));
if (read(fifo, buf, sizeof(buf)-1) > 1)
{
segment = atoi(&buf[1]);
if (segment)
{
switch (buf[0])
{
case '+':
this->segments->activate(this->segments, segment, TRUE);
break;
case '-':
this->segments->deactivate(this->segments, segment, TRUE);
break;
case '*':
this->segments->resync(this->segments, segment);
break;
default:
break;
}
}
}
close(fifo);
return JOB_REQUEUE_DIRECT;
}
/**
* Implementation of ha_ctl_t.destroy.
*/
static void destroy(private_ha_ctl_t *this)
{
this->job->cancel(this->job);
free(this);
}
/**
* See header
*/
ha_ctl_t *ha_ctl_create(ha_segments_t *segments)
{
private_ha_ctl_t *this = malloc_thing(private_ha_ctl_t);
this->public.destroy = (void(*)(ha_ctl_t*))destroy;
if (access(HA_FIFO, R_OK|W_OK) != 0)
{
if (mkfifo(HA_FIFO, 600) != 0)
{
DBG1(DBG_CFG, "creating HA FIFO %s failed: %s",
HA_FIFO, strerror(errno));
}
}
this->segments = segments;
this->job = callback_job_create((callback_job_cb_t)dispatch_fifo,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
return &this->public;
}
src/charon/plugins/ha/ha_ctl.h
-47
View File
@@ -1,47 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha_ctl ha_ctl
* @{ @ingroup ha
*/
#ifndef HA_CTL_H_
#define HA_CTL_H_
#include "ha_segments.h"
typedef struct ha_ctl_t ha_ctl_t;
/**
* HA Sync control interface using a FIFO.
*/
struct ha_ctl_t {
/**
* Destroy a ha_ctl_t.
*/
void (*destroy)(ha_ctl_t *this);
};
/**
* Create a ha_ctl instance.
*
* @param segments segments to control
* @return HA control interface
*/
ha_ctl_t *ha_ctl_create(ha_segments_t *segments);
#endif /* HA_CTL_ @}*/
src/charon/plugins/ha/ha_dispatcher.c
-737
View File
@@ -1,737 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ha_dispatcher.h"
#include <daemon.h>
#include <processing/jobs/callback_job.h>
typedef struct private_ha_dispatcher_t private_ha_dispatcher_t;
/**
* Private data of an ha_dispatcher_t object.
*/
struct private_ha_dispatcher_t {
/**
* Public ha_dispatcher_t interface.
*/
ha_dispatcher_t public;
/**
* socket to pull messages from
*/
ha_socket_t *socket;
/**
* segments to control
*/
ha_segments_t *segments;
/**
* Dispatcher job
*/
callback_job_t *job;
};
/**
* Quick and dirty hack implementation of diffie_hellman_t.get_shared_secret
*/
static status_t get_shared_secret(diffie_hellman_t *this, chunk_t *secret)
{
*secret = chunk_clone((*(chunk_t*)this->destroy));
return SUCCESS;
}
/**
* Process messages of type IKE_ADD
*/
static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message)
{
ha_message_attribute_t attribute;
ha_message_value_t value;
enumerator_t *enumerator;
ike_sa_t *ike_sa = NULL, *old_sa = NULL;
u_int16_t encr = 0, len = 0, integ = 0, prf = 0, old_prf = PRF_UNDEFINED;
chunk_t nonce_i = chunk_empty, nonce_r = chunk_empty;
chunk_t secret = chunk_empty, old_skd = chunk_empty;
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
{
switch (attribute)
{
case HA_IKE_ID:
ike_sa = ike_sa_create(value.ike_sa_id);
break;
case HA_IKE_REKEY_ID:
old_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
value.ike_sa_id);
break;
case HA_NONCE_I:
nonce_i = value.chunk;
break;
case HA_NONCE_R:
nonce_r = value.chunk;
break;
case HA_SECRET:
secret = value.chunk;
break;
case HA_OLD_SKD:
old_skd = value.chunk;
break;
case HA_ALG_ENCR:
encr = value.u16;
break;
case HA_ALG_ENCR_LEN:
len = value.u16;
break;
case HA_ALG_INTEG:
integ = value.u16;
break;
case HA_ALG_PRF:
prf = value.u16;
break;
case HA_ALG_OLD_PRF:
old_prf = value.u16;
break;
default:
break;
}
}
enumerator->destroy(enumerator);
if (ike_sa)
{
proposal_t *proposal;
keymat_t *keymat;
/* quick and dirty hack of a DH implementation ;-) */
diffie_hellman_t dh = { .get_shared_secret = get_shared_secret,
.destroy = (void*)&secret };
proposal = proposal_create(PROTO_IKE);
keymat = ike_sa->get_keymat(ike_sa);
if (integ)
{
proposal->add_algorithm(proposal, INTEGRITY_ALGORITHM, integ, 0);
}
if (encr)
{
proposal->add_algorithm(proposal, ENCRYPTION_ALGORITHM, encr, len);
}
if (prf)
{
proposal->add_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, prf, 0);
}
charon->bus->set_sa(charon->bus, ike_sa);
if (keymat->derive_ike_keys(keymat, proposal, &dh, nonce_i, nonce_r,
ike_sa->get_id(ike_sa), old_prf, old_skd))
{
if (old_sa)
{
peer_cfg_t *peer_cfg = old_sa->get_peer_cfg(old_sa);
if (peer_cfg)
{
ike_sa->set_peer_cfg(ike_sa, peer_cfg);
ike_sa->inherit(ike_sa, old_sa);
}
charon->ike_sa_manager->checkin_and_destroy(
charon->ike_sa_manager, old_sa);
old_sa = NULL;
}
ike_sa->set_state(ike_sa, IKE_CONNECTING);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
}
else
{
DBG1(DBG_IKE, "HA keymat derivation failed");
ike_sa->destroy(ike_sa);
}
charon->bus->set_sa(charon->bus, NULL);
proposal->destroy(proposal);
}
if (old_sa)
{
charon->ike_sa_manager->checkin(charon->ike_sa_manager, old_sa);
}
}
/**
* Apply a condition flag to the IKE_SA if it is in set
*/
static void set_condition(ike_sa_t *ike_sa, ike_condition_t set,
ike_condition_t flag)
{
ike_sa->set_condition(ike_sa, flag, flag & set);
}
/**
* Apply a extension flag to the IKE_SA if it is in set
*/
static void set_extension(ike_sa_t *ike_sa, ike_extension_t set,
ike_extension_t flag)
{
if (flag & set)
{
ike_sa->enable_extension(ike_sa, flag);
}
}
/**
* Process messages of type IKE_UPDATE
*/
static void process_ike_update(private_ha_dispatcher_t *this,
ha_message_t *message)
{
ha_message_attribute_t attribute;
ha_message_value_t value;
enumerator_t *enumerator;
ike_sa_t *ike_sa = NULL;
peer_cfg_t *peer_cfg = NULL;
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
{
if (attribute != HA_IKE_ID && ike_sa == NULL)
{
/* must be first attribute */
break;
}
switch (attribute)
{
case HA_IKE_ID:
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
value.ike_sa_id);
break;
case HA_LOCAL_ID:
ike_sa->set_my_id(ike_sa, value.id->clone(value.id));
break;
case HA_REMOTE_ID:
ike_sa->set_other_id(ike_sa, value.id->clone(value.id));
break;
case HA_EAP_ID:
ike_sa->set_eap_identity(ike_sa, value.id->clone(value.id));
break;
case HA_LOCAL_ADDR:
ike_sa->set_my_host(ike_sa, value.host->clone(value.host));
break;
case HA_REMOTE_ADDR:
ike_sa->set_other_host(ike_sa, value.host->clone(value.host));
break;
case HA_LOCAL_VIP:
ike_sa->set_virtual_ip(ike_sa, TRUE, value.host);
break;
case HA_REMOTE_VIP:
ike_sa->set_virtual_ip(ike_sa, FALSE, value.host);
break;
case HA_ADDITIONAL_ADDR:
ike_sa->add_additional_address(ike_sa,
value.host->clone(value.host));
break;
case HA_CONFIG_NAME:
peer_cfg = charon->backends->get_peer_cfg_by_name(
charon->backends, value.str);
if (peer_cfg)
{
ike_sa->set_peer_cfg(ike_sa, peer_cfg);
peer_cfg->destroy(peer_cfg);
}
else
{
DBG1(DBG_IKE, "HA is missing nodes peer configuration");
}
break;
case HA_EXTENSIONS:
set_extension(ike_sa, value.u32, EXT_NATT);
set_extension(ike_sa, value.u32, EXT_MOBIKE);
set_extension(ike_sa, value.u32, EXT_HASH_AND_URL);
break;
case HA_CONDITIONS:
set_condition(ike_sa, value.u32, COND_NAT_ANY);
set_condition(ike_sa, value.u32, COND_NAT_HERE);
set_condition(ike_sa, value.u32, COND_NAT_THERE);
set_condition(ike_sa, value.u32, COND_NAT_FAKE);
set_condition(ike_sa, value.u32, COND_EAP_AUTHENTICATED);
set_condition(ike_sa, value.u32, COND_CERTREQ_SEEN);
set_condition(ike_sa, value.u32, COND_ORIGINAL_INITIATOR);
break;
case HA_INITIATE_MID:
ike_sa->set_message_id(ike_sa, TRUE, value.u32);
break;
case HA_RESPOND_MID:
ike_sa->set_message_id(ike_sa, FALSE, value.u32);
break;
default:
break;
}
}
enumerator->destroy(enumerator);
if (ike_sa)
{
if (ike_sa->get_state(ike_sa) == IKE_CONNECTING &&
ike_sa->get_peer_cfg(ike_sa))
{
ike_sa->set_state(ike_sa, IKE_PASSIVE);
}
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
}
}
/**
* Process messages of type IKE_DELETE
*/
static void process_ike_delete(private_ha_dispatcher_t *this,
ha_message_t *message)
{
ha_message_attribute_t attribute;
ha_message_value_t value;
enumerator_t *enumerator;
ike_sa_t *ike_sa;
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
{
switch (attribute)
{
case HA_IKE_ID:
ike_sa = charon->ike_sa_manager->checkout(
charon->ike_sa_manager, value.ike_sa_id);
if (ike_sa)
{
charon->ike_sa_manager->checkin_and_destroy(
charon->ike_sa_manager, ike_sa);
}
break;
default:
break;
}
}
enumerator->destroy(enumerator);
}
/**
* Lookup a child cfg from the peer cfg by name
*/
static child_cfg_t* find_child_cfg(ike_sa_t *ike_sa, char *name)
{
peer_cfg_t *peer_cfg;
child_cfg_t *current, *found = NULL;
enumerator_t *enumerator;
peer_cfg = ike_sa->get_peer_cfg(ike_sa);
if (peer_cfg)
{
enumerator = peer_cfg->create_child_cfg_enumerator(peer_cfg);
while (enumerator->enumerate(enumerator, &current))
{
if (streq(current->get_name(current), name))
{
found = current;
break;
}
}
enumerator->destroy(enumerator);
}
return found;
}
/**
* Process messages of type CHILD_ADD
*/
static void process_child_add(private_ha_dispatcher_t *this,
ha_message_t *message)
{
ha_message_attribute_t attribute;
ha_message_value_t value;
enumerator_t *enumerator;
ike_sa_t *ike_sa = NULL;
char *config_name;
child_cfg_t *config = NULL;
child_sa_t *child_sa;
proposal_t *proposal;
keymat_t *keymat;
bool initiator, failed = FALSE;
u_int32_t inbound_spi = 0, outbound_spi = 0;
u_int16_t inbound_cpi = 0, outbound_cpi = 0;
u_int8_t mode = MODE_TUNNEL, ipcomp = 0;
u_int16_t encr = ENCR_UNDEFINED, integ = AUTH_UNDEFINED, len = 0;
chunk_t nonce_i = chunk_empty, nonce_r = chunk_empty, secret = chunk_empty;
chunk_t encr_i, integ_i, encr_r, integ_r;
linked_list_t *local_ts, *remote_ts;
/* quick and dirty hack of a DH implementation */
diffie_hellman_t dh = { .get_shared_secret = get_shared_secret,
.destroy = (void*)&secret };
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
{
switch (attribute)
{
case HA_IKE_ID:
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
value.ike_sa_id);
initiator = value.ike_sa_id->is_initiator(value.ike_sa_id);
break;
case HA_CONFIG_NAME:
config_name = value.str;
break;
case HA_INBOUND_SPI:
inbound_spi = value.u32;
break;
case HA_OUTBOUND_SPI:
outbound_spi = value.u32;
break;
case HA_INBOUND_CPI:
inbound_cpi = value.u32;
break;
case HA_OUTBOUND_CPI:
outbound_cpi = value.u32;
break;
case HA_IPSEC_MODE:
mode = value.u8;
break;
case HA_IPCOMP:
ipcomp = value.u8;
break;
case HA_ALG_ENCR:
encr = value.u16;
break;
case HA_ALG_ENCR_LEN:
len = value.u16;
break;
case HA_ALG_INTEG:
integ = value.u16;
break;
case HA_NONCE_I:
nonce_i = value.chunk;
break;
case HA_NONCE_R:
nonce_r = value.chunk;
break;
case HA_SECRET:
secret = value.chunk;
break;
default:
break;
}
}
enumerator->destroy(enumerator);
if (!ike_sa)
{
DBG1(DBG_CHD, "IKE_SA for HA CHILD_SA not found");
return;
}
config = find_child_cfg(ike_sa, config_name);
if (!config)
{
DBG1(DBG_CHD, "HA is missing nodes child configuration");
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
return;
}
child_sa = child_sa_create(ike_sa->get_my_host(ike_sa),
ike_sa->get_other_host(ike_sa), config, 0,
ike_sa->has_condition(ike_sa, COND_NAT_ANY));
child_sa->set_mode(child_sa, mode);
child_sa->set_protocol(child_sa, PROTO_ESP);
child_sa->set_ipcomp(child_sa, ipcomp);
proposal = proposal_create(PROTO_ESP);
if (integ)
{
proposal->add_algorithm(proposal, INTEGRITY_ALGORITHM, integ, 0);
}
if (encr)
{
proposal->add_algorithm(proposal, ENCRYPTION_ALGORITHM, encr, len);
}
keymat = ike_sa->get_keymat(ike_sa);
if (!keymat->derive_child_keys(keymat, proposal, secret.ptr ? &dh : NULL,
nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
{
DBG1(DBG_CHD, "HA CHILD_SA key derivation failed");
child_sa->destroy(child_sa);
proposal->destroy(proposal);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
return;
}
child_sa->set_proposal(child_sa, proposal);
child_sa->set_state(child_sa, CHILD_INSTALLING);
proposal->destroy(proposal);
if (initiator)
{
if (child_sa->install(child_sa, encr_r, integ_r,
inbound_spi, inbound_cpi, TRUE) != SUCCESS ||
child_sa->install(child_sa, encr_i, integ_i,
outbound_spi, outbound_cpi, FALSE) != SUCCESS)
{
failed = TRUE;
}
}
else
{
if (child_sa->install(child_sa, encr_i, integ_i,
inbound_spi, inbound_cpi, TRUE) != SUCCESS ||
child_sa->install(child_sa, encr_r, integ_r,
outbound_spi, outbound_cpi, FALSE) != SUCCESS)
{
failed = TRUE;
}
}
chunk_clear(&encr_i);
chunk_clear(&integ_i);
chunk_clear(&encr_r);
chunk_clear(&integ_r);
if (failed)
{
DBG1(DBG_CHD, "HA CHILD_SA installation failed");
child_sa->destroy(child_sa);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
return;
}
/* TODO: Change CHILD_SA API to avoid cloning twice */
local_ts = linked_list_create();
remote_ts = linked_list_create();
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
{
switch (attribute)
{
case HA_LOCAL_TS:
local_ts->insert_last(local_ts, value.ts->clone(value.ts));
break;
case HA_REMOTE_TS:
remote_ts->insert_last(remote_ts, value.ts->clone(value.ts));
break;
default:
break;
}
}
enumerator->destroy(enumerator);
child_sa->add_policies(child_sa, local_ts, remote_ts);
local_ts->destroy_offset(local_ts, offsetof(traffic_selector_t, destroy));
remote_ts->destroy_offset(remote_ts, offsetof(traffic_selector_t, destroy));
child_sa->set_state(child_sa, CHILD_INSTALLED);
ike_sa->add_child_sa(ike_sa, child_sa);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
}
/**
* Process messages of type CHILD_DELETE
*/
static void process_child_delete(private_ha_dispatcher_t *this,
ha_message_t *message)
{
ha_message_attribute_t attribute;
ha_message_value_t value;
enumerator_t *enumerator;
ike_sa_t *ike_sa = NULL;
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
{
switch (attribute)
{
case HA_IKE_ID:
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
value.ike_sa_id);
break;
case HA_INBOUND_SPI:
if (ike_sa)
{
ike_sa->destroy_child_sa(ike_sa, PROTO_ESP, value.u32);
}
break;
default:
break;
}
}
if (ike_sa)
{
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
}
enumerator->destroy(enumerator);
}
/**
* Process messages of type SEGMENT_TAKE/DROP
*/
static void process_segment(private_ha_dispatcher_t *this,
ha_message_t *message, bool take)
{
ha_message_attribute_t attribute;
ha_message_value_t value;
enumerator_t *enumerator;
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
{
switch (attribute)
{
case HA_SEGMENT:
if (take)
{
DBG1(DBG_CFG, "remote node takes segment %d", value.u16);
this->segments->deactivate(this->segments, value.u16, FALSE);
}
else
{
DBG1(DBG_CFG, "remote node drops segment %d", value.u16);
this->segments->activate(this->segments, value.u16, FALSE);
}
break;
default:
break;
}
}
enumerator->destroy(enumerator);
}
/**
* Process messages of type STATUS
*/
static void process_status(private_ha_dispatcher_t *this,
ha_message_t *message)
{
ha_message_attribute_t attribute;
ha_message_value_t value;
enumerator_t *enumerator;
segment_mask_t mask = 0;
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
{
switch (attribute)
{
case HA_SEGMENT:
mask |= SEGMENTS_BIT(value.u16);
break;
default:
break;
}
}
enumerator->destroy(enumerator);
this->segments->handle_status(this->segments, mask);
}
/**
* Process messages of type RESYNC
*/
static void process_resync(private_ha_dispatcher_t *this,
ha_message_t *message)
{
ha_message_attribute_t attribute;
ha_message_value_t value;
enumerator_t *enumerator;
enumerator = message->create_attribute_enumerator(message);
while (enumerator->enumerate(enumerator, &attribute, &value))
{
switch (attribute)
{
case HA_SEGMENT:
this->segments->resync(this->segments, value.u16);
break;
default:
break;
}
}
enumerator->destroy(enumerator);
}
/**
* Dispatcher job function
*/
static job_requeue_t dispatch(private_ha_dispatcher_t *this)
{
ha_message_t *message;
message = this->socket->pull(this->socket);
switch (message->get_type(message))
{
case HA_IKE_ADD:
process_ike_add(this, message);
break;
case HA_IKE_UPDATE:
process_ike_update(this, message);
break;
case HA_IKE_DELETE:
process_ike_delete(this, message);
break;
case HA_CHILD_ADD:
process_child_add(this, message);
break;
case HA_CHILD_DELETE:
process_child_delete(this, message);
break;
case HA_SEGMENT_DROP:
process_segment(this, message, FALSE);
break;
case HA_SEGMENT_TAKE:
process_segment(this, message, TRUE);
break;
case HA_STATUS:
process_status(this, message);
break;
case HA_RESYNC:
process_resync(this, message);
break;
default:
DBG1(DBG_CFG, "received unknown HA message type %d",
message->get_type(message));
break;
}
message->destroy(message);
return JOB_REQUEUE_DIRECT;
}
/**
* Implementation of ha_dispatcher_t.destroy.
*/
static void destroy(private_ha_dispatcher_t *this)
{
this->job->cancel(this->job);
free(this);
}
/**
* See header
*/
ha_dispatcher_t *ha_dispatcher_create(ha_socket_t *socket,
ha_segments_t *segments)
{
private_ha_dispatcher_t *this = malloc_thing(private_ha_dispatcher_t);
this->public.destroy = (void(*)(ha_dispatcher_t*))destroy;
this->socket = socket;
this->segments = segments;
this->job = callback_job_create((callback_job_cb_t)dispatch,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
return &this->public;
}
src/charon/plugins/ha/ha_dispatcher.h
-50
View File
@@ -1,50 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha_dispatcher ha_dispatcher
* @{ @ingroup ha
*/
#ifndef HA_DISPATCHER_H_
#define HA_DISPATCHER_H_
#include "ha_socket.h"
#include "ha_segments.h"
typedef struct ha_dispatcher_t ha_dispatcher_t;
/**
* The dispatcher pulls messages in a thread an processes them.
*/
struct ha_dispatcher_t {
/**
* Destroy a ha_dispatcher_t.
*/
void (*destroy)(ha_dispatcher_t *this);
};
/**
* Create a ha_dispatcher instance pulling from socket.
*
* @param socket socket to pull messages from
* @param segments segments to control based on received messages
* @return dispatcher object
*/
ha_dispatcher_t *ha_dispatcher_create(ha_socket_t *socket,
ha_segments_t *segments);
#endif /* HA_DISPATCHER_ @}*/
src/charon/plugins/ha/ha_ike.c
-286
View File
@@ -1,286 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ha_ike.h"
typedef struct private_ha_ike_t private_ha_ike_t;
/**
* Private data of an ha_ike_t object.
*/
struct private_ha_ike_t {
/**
* Public ha_ike_t interface.
*/
ha_ike_t public;
/**
* socket we use for syncing
*/
ha_socket_t *socket;
/**
* tunnel securing sync messages
*/
ha_tunnel_t *tunnel;
};
/**
* Return condition if it is set on ike_sa
*/
static ike_condition_t copy_condition(ike_sa_t *ike_sa, ike_condition_t cond)
{
if (ike_sa->has_condition(ike_sa, cond))
{
return cond;
}
return 0;
}
/**
* Return extension if it is supported by peers IKE_SA
*/
static ike_extension_t copy_extension(ike_sa_t *ike_sa, ike_extension_t ext)
{
if (ike_sa->supports_extension(ike_sa, ext))
{
return ext;
}
return 0;
}
/**
* Implementation of listener_t.ike_keys
*/
static bool ike_keys(private_ha_ike_t *this, ike_sa_t *ike_sa,
diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r,
ike_sa_t *rekey)
{
ha_message_t *m;
chunk_t secret;
proposal_t *proposal;
u_int16_t alg, len;
if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
{ /* do not sync SA between nodes */
return TRUE;
}
if (dh->get_shared_secret(dh, &secret) != SUCCESS)
{
return TRUE;
}
m = ha_message_create(HA_IKE_ADD);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
if (rekey)
{
chunk_t skd;
keymat_t *keymat;
keymat = rekey->get_keymat(rekey);
m->add_attribute(m, HA_IKE_REKEY_ID, rekey->get_id(rekey));
m->add_attribute(m, HA_ALG_OLD_PRF, keymat->get_skd(keymat, &skd));
m->add_attribute(m, HA_OLD_SKD, skd);
}
proposal = ike_sa->get_proposal(ike_sa);
if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &len))
{
m->add_attribute(m, HA_ALG_ENCR, alg);
if (len)
{
m->add_attribute(m, HA_ALG_ENCR_LEN, len);
}
}
if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
{
m->add_attribute(m, HA_ALG_INTEG, alg);
}
if (proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL))
{
m->add_attribute(m, HA_ALG_PRF, alg);
}
m->add_attribute(m, HA_NONCE_I, nonce_i);
m->add_attribute(m, HA_NONCE_R, nonce_r);
m->add_attribute(m, HA_SECRET, secret);
chunk_clear(&secret);
this->socket->push(this->socket, m);
return TRUE;
}
/**
* Implementation of listener_t.ike_updown
*/
static bool ike_updown(private_ha_ike_t *this, ike_sa_t *ike_sa, bool up)
{
ha_message_t *m;
if (ike_sa->get_state(ike_sa) == IKE_PASSIVE)
{ /* only sync active IKE_SAs */
return TRUE;
}
if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
{ /* do not sync SA between nodes */
return TRUE;
}
if (up)
{
iterator_t *iterator;
peer_cfg_t *peer_cfg;
u_int32_t extension, condition;
host_t *addr;
identification_t *eap_id;
ike_sa_id_t *id;
peer_cfg = ike_sa->get_peer_cfg(ike_sa);
condition = copy_condition(ike_sa, COND_NAT_ANY)
| copy_condition(ike_sa, COND_NAT_HERE)
| copy_condition(ike_sa, COND_NAT_THERE)
| copy_condition(ike_sa, COND_NAT_FAKE)
| copy_condition(ike_sa, COND_EAP_AUTHENTICATED)
| copy_condition(ike_sa, COND_CERTREQ_SEEN)
| copy_condition(ike_sa, COND_ORIGINAL_INITIATOR);
extension = copy_extension(ike_sa, EXT_NATT)
| copy_extension(ike_sa, EXT_MOBIKE)
| copy_extension(ike_sa, EXT_HASH_AND_URL);
eap_id = ike_sa->get_eap_identity(ike_sa);
id = ike_sa->get_id(ike_sa);
m = ha_message_create(HA_IKE_UPDATE);
m->add_attribute(m, HA_IKE_ID, id);
m->add_attribute(m, HA_LOCAL_ID, ike_sa->get_my_id(ike_sa));
m->add_attribute(m, HA_REMOTE_ID, ike_sa->get_other_id(ike_sa));
m->add_attribute(m, HA_LOCAL_ADDR, ike_sa->get_my_host(ike_sa));
m->add_attribute(m, HA_REMOTE_ADDR, ike_sa->get_other_host(ike_sa));
m->add_attribute(m, HA_CONDITIONS, condition);
m->add_attribute(m, HA_EXTENSIONS, extension);
m->add_attribute(m, HA_CONFIG_NAME, peer_cfg->get_name(peer_cfg));
if (eap_id)
{
m->add_attribute(m, HA_EAP_ID, eap_id);
}
iterator = ike_sa->create_additional_address_iterator(ike_sa);
while (iterator->iterate(iterator, (void**)&addr))
{
m->add_attribute(m, HA_ADDITIONAL_ADDR, addr);
}
iterator->destroy(iterator);
}
else
{
m = ha_message_create(HA_IKE_DELETE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
}
this->socket->push(this->socket, m);
return TRUE;
}
/**
* Implementation of listener_t.ike_rekey
*/
static bool ike_rekey(private_ha_ike_t *this, ike_sa_t *old, ike_sa_t *new)
{
ike_updown(this, old, FALSE);
ike_updown(this, new, TRUE);
return TRUE;
}
/**
* Implementation of listener_t.message
*/
static bool message_hook(private_ha_ike_t *this, ike_sa_t *ike_sa,
message_t *message, bool incoming)
{
if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
{ /* do not sync SA between nodes */
return TRUE;
}
if (message->get_exchange_type(message) != IKE_SA_INIT &&
message->get_request(message))
{ /* we sync on requests, but skip it on IKE_SA_INIT */
ha_message_t *m;
u_int32_t mid;
m = ha_message_create(HA_IKE_UPDATE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
mid = message->get_message_id(message) + 1;
if (incoming)
{
m->add_attribute(m, HA_RESPOND_MID, mid);
}
else
{
m->add_attribute(m, HA_INITIATE_MID, mid);
}
this->socket->push(this->socket, m);
}
if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
message->get_exchange_type(message) == IKE_AUTH &&
!message->get_request(message))
{ /* After IKE_SA has been established, sync peers virtual IP.
* We cannot sync it in the state_change hook, it is installed later.
* TODO: where to sync local VIP? */
ha_message_t *m;
host_t *vip;
vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
if (vip)
{
m = ha_message_create(HA_IKE_UPDATE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
m->add_attribute(m, HA_REMOTE_VIP, vip);
this->socket->push(this->socket, m);
}
}
return TRUE;
}
/**
* Implementation of ha_ike_t.destroy.
*/
static void destroy(private_ha_ike_t *this)
{
free(this);
}
/**
* See header
*/
ha_ike_t *ha_ike_create(ha_socket_t *socket, ha_tunnel_t *tunnel)
{
private_ha_ike_t *this = malloc_thing(private_ha_ike_t);
memset(&this->public.listener, 0, sizeof(listener_t));
this->public.listener.ike_keys = (bool(*)(listener_t*, ike_sa_t *ike_sa, diffie_hellman_t *dh,chunk_t nonce_i, chunk_t nonce_r, ike_sa_t *rekey))ike_keys;
this->public.listener.ike_updown = (bool(*)(listener_t*,ike_sa_t *ike_sa, bool up))ike_updown;
this->public.listener.ike_rekey = (bool(*)(listener_t*,ike_sa_t *old, ike_sa_t *new))ike_rekey;
this->public.listener.message = (bool(*)(listener_t*, ike_sa_t *, message_t *,bool))message_hook;
this->public.destroy = (void(*)(ha_ike_t*))destroy;
this->socket = socket;
this->tunnel = tunnel;
return &this->public;
}
src/charon/plugins/ha/ha_ike.h
-57
View File
@@ -1,57 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha_ike ha_ike
* @{ @ingroup ha
*/
#ifndef HA_IKE_H_
#define HA_IKE_H_
#include "ha_socket.h"
#include "ha_tunnel.h"
#include "ha_segments.h"
#include <daemon.h>
typedef struct ha_ike_t ha_ike_t;
/**
* Listener to synchronize IKE_SAs.
*/
struct ha_ike_t {
/**
* Implements bus listener interface.
*/
listener_t listener;
/**
* Destroy a ha_ike_t.
*/
void (*destroy)(ha_ike_t *this);
};
/**
* Create a ha_ike instance.
*
* @param socket socket to use for sending synchronization messages
* @param tunnel tunnel securing sync messages, if any
* @return IKE listener
*/
ha_ike_t *ha_ike_create(ha_socket_t *socket, ha_tunnel_t *tunnel);
#endif /* HA_IKE_ @}*/
src/charon/plugins/ha/ha_kernel.c
-229
View File
@@ -1,229 +0,0 @@
/*
* Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ha_kernel.h"
typedef u_int32_t u32;
typedef u_int8_t u8;
#include <linux/jhash.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#define CLUSTERIP_DIR "/proc/net/ipt_CLUSTERIP"
typedef struct private_ha_kernel_t private_ha_kernel_t;
/**
* Private data of an ha_kernel_t object.
*/
struct private_ha_kernel_t {
/**
* Public ha_kernel_t interface.
*/
ha_kernel_t public;
/**
* Init value for jhash
*/
u_int initval;
/**
* Total number of ClusterIP segments
*/
u_int count;
};
/**
* Implementation of ha_kernel_t.in_segment
*/
static bool in_segment(private_ha_kernel_t *this, host_t *host, u_int segment)
{
if (host->get_family(host) == AF_INET)
{
unsigned long hash;
u_int32_t addr;
addr = *(u_int32_t*)host->get_address(host).ptr;
hash = jhash_1word(ntohl(addr), this->initval);
if ((((u_int64_t)hash * this->count) >> 32) + 1 == segment)
{
return TRUE;
}
}
return FALSE;
}
/**
* Activate/Deactivate a segment for a given clusterip file
*/
static void enable_disable(private_ha_kernel_t *this, u_int segment,
char *file, bool enable)
{
char cmd[8];
int fd;
snprintf(cmd, sizeof(cmd), "%c%d\n", enable ? '+' : '-', segment);
fd = open(file, O_WRONLY);
if (fd == -1)
{
DBG1(DBG_CFG, "opening CLUSTERIP file '%s' failed: %s",
file, strerror(errno));
return;
}
if (write(fd, cmd, strlen(cmd) == -1))
{
DBG1(DBG_CFG, "writing to CLUSTERIP file '%s' failed: %s",
file, strerror(errno));
}
close(fd);
}
/**
* Get the currenlty active segments in the kernel for a clusterip file
*/
static segment_mask_t get_active(private_ha_kernel_t *this, char *file)
{
char buf[256];
segment_mask_t mask = 0;
ssize_t len;
int fd;
fd = open(file, O_RDONLY);
if (fd == -1)
{
DBG1(DBG_CFG, "opening CLUSTERIP file '%s' failed: %s",
file, strerror(errno));
return 0;
}
len = read(fd, buf, sizeof(buf)-1);
if (len == -1)
{
DBG1(DBG_CFG, "reading from CLUSTERIP file '%s' failed: %s",
file, strerror(errno));
}
else
{
enumerator_t *enumerator;
u_int segment;
char *token;
buf[len] = '\0';
enumerator = enumerator_create_token(buf, ",", " ");
while (enumerator->enumerate(enumerator, &token))
{
segment = atoi(token);
if (segment)
{
mask |= SEGMENTS_BIT(segment);
}
}
enumerator->destroy(enumerator);
}
return mask;
}
/**
* Implementation of ha_kernel_t.activate
*/
static void activate(private_ha_kernel_t *this, u_int segment)
{
enumerator_t *enumerator;
char *file;
enumerator = enumerator_create_directory(CLUSTERIP_DIR);
while (enumerator->enumerate(enumerator, NULL, &file, NULL))
{
enable_disable(this, segment, file, TRUE);
}
enumerator->destroy(enumerator);
}
/**
* Implementation of ha_kernel_t.deactivate
*/
static void deactivate(private_ha_kernel_t *this, u_int segment)
{
enumerator_t *enumerator;
char *file;
enumerator = enumerator_create_directory(CLUSTERIP_DIR);
while (enumerator->enumerate(enumerator, NULL, &file, NULL))
{
enable_disable(this, segment, file, FALSE);
}
enumerator->destroy(enumerator);
}
/**
* Disable all not-yet disabled segments on all clusterip addresses
*/
static void disable_all(private_ha_kernel_t *this)
{
enumerator_t *enumerator;
segment_mask_t active;
char *file;
int i;
enumerator = enumerator_create_directory(CLUSTERIP_DIR);
while (enumerator->enumerate(enumerator, NULL, &file, NULL))
{
active = get_active(this, file);
for (i = 1; i <= this->count; i++)
{
if (active & SEGMENTS_BIT(i))
{
enable_disable(this, i, file, FALSE);
}
}
}
enumerator->destroy(enumerator);
}
/**
* Implementation of ha_kernel_t.destroy.
*/
static void destroy(private_ha_kernel_t *this)
{
free(this);
}
/**
* See header
*/
ha_kernel_t *ha_kernel_create(u_int count)
{
private_ha_kernel_t *this = malloc_thing(private_ha_kernel_t);
this->public.in_segment = (bool(*)(ha_kernel_t*, host_t *host, u_int segment))in_segment;
this->public.activate = (void(*)(ha_kernel_t*, u_int segment))activate;
this->public.deactivate = (void(*)(ha_kernel_t*, u_int segment))deactivate;
this->public.destroy = (void(*)(ha_kernel_t*))destroy;
this->initval = 0;
this->count = count;
disable_all(this);
return &this->public;
}
src/charon/plugins/ha/ha_kernel.h
-70
View File
@@ -1,70 +0,0 @@
/*
* Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha_kernel ha_kernel
* @{ @ingroup ha
*/
#ifndef HA_KERNEL_H_
#define HA_KERNEL_H_
typedef struct ha_kernel_t ha_kernel_t;
#include "ha_segments.h"
/**
* HA segment kernel configuration interface.
*/
struct ha_kernel_t {
/**
* Check if a host is in a segment.
*
* @param host host to check
* @param segment segment
* @return TRUE if host belongs to segment
*/
bool (*in_segment)(ha_kernel_t *this, host_t *host, u_int segment);
/**
* Activate a segment at kernel level for all cluster addresses.
*
* @param segment segment to activate
*/
void (*activate)(ha_kernel_t *this, u_int segment);
/**
* Deactivate a segment at kernel level for all cluster addresses.
*
* @param segment segment to deactivate
*/
void (*deactivate)(ha_kernel_t *this, u_int segment);
/**
* Destroy a ha_kernel_t.
*/
void (*destroy)(ha_kernel_t *this);
};
/**
* Create a ha_kernel instance.
*
* @param count total number of segments to use
* @param active bitmask of initially active segments
*/
ha_kernel_t *ha_kernel_create(u_int count);
#endif /* HA_KERNEL_ @}*/
src/charon/plugins/ha/ha_message.c
-665
View File
@@ -1,665 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#define _GNU_SOURCE
#include <string.h>
#include <arpa/inet.h>
#include "ha_message.h"
#include <daemon.h>
#define ALLOCATION_BLOCK 64
typedef struct private_ha_message_t private_ha_message_t;
/**
* Private data of an ha_message_t object.
*/
struct private_ha_message_t {
/**
* Public ha_message_t interface.
*/
ha_message_t public;
/**
* Allocated size of buf
*/
size_t allocated;
/**
* Buffer containing encoded data
*/
chunk_t buf;
};
typedef struct ike_sa_id_encoding_t ike_sa_id_encoding_t;
/**
* Encoding if an ike_sa_id_t
*/
struct ike_sa_id_encoding_t {
u_int64_t initiator_spi;
u_int64_t responder_spi;
u_int8_t initiator;
} __attribute__((packed));
typedef struct identification_encoding_t identification_encoding_t;
/**
* Encoding of a identification_t
*/
struct identification_encoding_t {
u_int8_t type;
u_int8_t len;
char encoding[];
} __attribute__((packed));
typedef struct host_encoding_t host_encoding_t;
/**
* encoding of a host_t
*/
struct host_encoding_t {
u_int16_t port;
u_int8_t family;
char encoding[];
} __attribute__((packed));
typedef struct ts_encoding_t ts_encoding_t;
/**
* encoding of a traffic_selector_t
*/
struct ts_encoding_t {
u_int8_t type;
u_int8_t protocol;
u_int16_t from_port;
u_int16_t to_port;
u_int8_t dynamic;
char encoding[];
} __attribute__((packed));
/**
* Implementation of ha_message_t.get_type
*/
static ha_message_type_t get_type(private_ha_message_t *this)
{
return this->buf.ptr[1];
}
/**
* check for space in buffer, increase if necessary
*/
static void check_buf(private_ha_message_t *this, size_t len)
{
int increased = 0;
while (this->buf.len + len > this->allocated)
{ /* double size */
this->allocated += ALLOCATION_BLOCK;
increased++;
}
if (increased)
{
this->buf.ptr = realloc(this->buf.ptr, this->allocated);
}
}
/**
* Implementation of ha_message_t.add_attribute
*/
static void add_attribute(private_ha_message_t *this,
ha_message_attribute_t attribute, ...)
{
size_t len;
va_list args;
check_buf(this, sizeof(u_int8_t));
this->buf.ptr[this->buf.len] = attribute;
this->buf.len += sizeof(u_int8_t);
va_start(args, attribute);
switch (attribute)
{
/* ike_sa_id_t* */
case HA_IKE_ID:
case HA_IKE_REKEY_ID:
{
ike_sa_id_encoding_t *enc;
ike_sa_id_t *id;
id = va_arg(args, ike_sa_id_t*);
check_buf(this, sizeof(ike_sa_id_encoding_t));
enc = (ike_sa_id_encoding_t*)(this->buf.ptr + this->buf.len);
this->buf.len += sizeof(ike_sa_id_encoding_t);
enc->initiator = id->is_initiator(id);
enc->initiator_spi = id->get_initiator_spi(id);
enc->responder_spi = id->get_responder_spi(id);
break;
}
/* identification_t* */
case HA_LOCAL_ID:
case HA_REMOTE_ID:
case HA_EAP_ID:
{
identification_encoding_t *enc;
identification_t *id;
chunk_t data;
id = va_arg(args, identification_t*);
data = id->get_encoding(id);
check_buf(this, sizeof(identification_encoding_t) + data.len);
enc = (identification_encoding_t*)(this->buf.ptr + this->buf.len);
this->buf.len += sizeof(identification_encoding_t) + data.len;
enc->type = id->get_type(id);
enc->len = data.len;
memcpy(enc->encoding, data.ptr, data.len);
break;
}
/* host_t* */
case HA_LOCAL_ADDR:
case HA_REMOTE_ADDR:
case HA_LOCAL_VIP:
case HA_REMOTE_VIP:
case HA_ADDITIONAL_ADDR:
{
host_encoding_t *enc;
host_t *host;
chunk_t data;
host = va_arg(args, host_t*);
data = host->get_address(host);
check_buf(this, sizeof(host_encoding_t) + data.len);
enc = (host_encoding_t*)(this->buf.ptr + this->buf.len);
this->buf.len += sizeof(host_encoding_t) + data.len;
enc->family = host->get_family(host);
enc->port = htons(host->get_port(host));
memcpy(enc->encoding, data.ptr, data.len);
break;
}
/* char* */
case HA_CONFIG_NAME:
{
char *str;
str = va_arg(args, char*);
len = strlen(str) + 1;
check_buf(this, len);
memcpy(this->buf.ptr + this->buf.len, str, len);
this->buf.len += len;
break;
}
/* u_int8_t */
case HA_IPSEC_MODE:
case HA_IPCOMP:
{
u_int8_t val;
val = va_arg(args, u_int);
check_buf(this, sizeof(val));
this->buf.ptr[this->buf.len] = val;
this->buf.len += sizeof(val);
break;
}
/* u_int16_t */
case HA_ALG_PRF:
case HA_ALG_OLD_PRF:
case HA_ALG_ENCR:
case HA_ALG_ENCR_LEN:
case HA_ALG_INTEG:
case HA_INBOUND_CPI:
case HA_OUTBOUND_CPI:
case HA_SEGMENT:
{
u_int16_t val;
val = va_arg(args, u_int);
check_buf(this, sizeof(val));
*(u_int16_t*)(this->buf.ptr + this->buf.len) = htons(val);
this->buf.len += sizeof(val);
break;
}
/** u_int32_t */
case HA_CONDITIONS:
case HA_EXTENSIONS:
case HA_INBOUND_SPI:
case HA_OUTBOUND_SPI:
case HA_INITIATE_MID:
case HA_RESPOND_MID:
{
u_int32_t val;
val = va_arg(args, u_int);
check_buf(this, sizeof(val));
*(u_int32_t*)(this->buf.ptr + this->buf.len) = htonl(val);
this->buf.len += sizeof(val);
break;
}
/** chunk_t */
case HA_NONCE_I:
case HA_NONCE_R:
case HA_SECRET:
case HA_OLD_SKD:
{
chunk_t chunk;
chunk = va_arg(args, chunk_t);
check_buf(this, chunk.len + sizeof(u_int16_t));
*(u_int16_t*)(this->buf.ptr + this->buf.len) = htons(chunk.len);
memcpy(this->buf.ptr + this->buf.len + sizeof(u_int16_t),
chunk.ptr, chunk.len);
this->buf.len += chunk.len + sizeof(u_int16_t);;
break;
}
/** traffic_selector_t */
case HA_LOCAL_TS:
case HA_REMOTE_TS:
{
ts_encoding_t *enc;
traffic_selector_t *ts;
chunk_t data;
ts = va_arg(args, traffic_selector_t*);
data = chunk_cata("cc", ts->get_from_address(ts),
ts->get_to_address(ts));
check_buf(this, sizeof(ts_encoding_t) + data.len);
enc = (ts_encoding_t*)(this->buf.ptr + this->buf.len);
this->buf.len += sizeof(ts_encoding_t) + data.len;
enc->type = ts->get_type(ts);
enc->protocol = ts->get_protocol(ts);
enc->from_port = htons(ts->get_from_port(ts));
enc->to_port = htons(ts->get_to_port(ts));
enc->dynamic = ts->is_dynamic(ts);
memcpy(enc->encoding, data.ptr, data.len);
break;
}
default:
{
DBG1(DBG_CFG, "unable to encode, attribute %d unknown", attribute);
this->buf.len -= sizeof(u_int8_t);
break;
}
}
va_end(args);
}
/**
* Attribute enumerator implementation
*/
typedef struct {
/** implementes enumerator_t */
enumerator_t public;
/** position in message */
chunk_t buf;
/** cleanup handler of current element, if any */
void (*cleanup)(void* data);
/** data to pass to cleanup handler */
void *cleanup_data;
} attribute_enumerator_t;
/**
* Implementation of create_attribute_enumerator().enumerate
*/
static bool attribute_enumerate(attribute_enumerator_t *this,
ha_message_attribute_t *attr_out,
ha_message_value_t *value)
{
ha_message_attribute_t attr;
if (this->cleanup)
{
this->cleanup(this->cleanup_data);
this->cleanup = NULL;
}
if (this->buf.len < 1)
{
return FALSE;
}
attr = this->buf.ptr[0];
this->buf = chunk_skip(this->buf, 1);
switch (attr)
{
/* ike_sa_id_t* */
case HA_IKE_ID:
case HA_IKE_REKEY_ID:
{
ike_sa_id_encoding_t *enc;
if (this->buf.len < sizeof(ike_sa_id_encoding_t))
{
return FALSE;
}
enc = (ike_sa_id_encoding_t*)(this->buf.ptr);
value->ike_sa_id = ike_sa_id_create(enc->initiator_spi,
enc->responder_spi, enc->initiator);
*attr_out = attr;
this->cleanup = (void*)value->ike_sa_id->destroy;
this->cleanup_data = value->ike_sa_id;
this->buf = chunk_skip(this->buf, sizeof(ike_sa_id_encoding_t));
return TRUE;
}
/* identification_t* */
case HA_LOCAL_ID:
case HA_REMOTE_ID:
case HA_EAP_ID:
{
identification_encoding_t *enc;
enc = (identification_encoding_t*)(this->buf.ptr);
if (this->buf.len < sizeof(identification_encoding_t) ||
this->buf.len < sizeof(identification_encoding_t) + enc->len)
{
return FALSE;
}
value->id = identification_create_from_encoding(enc->type,
chunk_create(enc->encoding, enc->len));
*attr_out = attr;
this->cleanup = (void*)value->id->destroy;
this->cleanup_data = value->id;
this->buf = chunk_skip(this->buf,
sizeof(identification_encoding_t) + enc->len);
return TRUE;
}
/* host_t* */
case HA_LOCAL_ADDR:
case HA_REMOTE_ADDR:
case HA_LOCAL_VIP:
case HA_REMOTE_VIP:
case HA_ADDITIONAL_ADDR:
{
host_encoding_t *enc;
enc = (host_encoding_t*)(this->buf.ptr);
if (this->buf.len < sizeof(host_encoding_t))
{
return FALSE;
}
value->host = host_create_from_chunk(enc->family,
chunk_create(enc->encoding,
this->buf.len - sizeof(host_encoding_t)),
ntohs(enc->port));
if (!value->host)
{
return FALSE;
}
*attr_out = attr;
this->cleanup = (void*)value->host->destroy;
this->cleanup_data = value->host;
this->buf = chunk_skip(this->buf, sizeof(host_encoding_t) +
value->host->get_address(value->host).len);
return TRUE;
}
/* char* */
case HA_CONFIG_NAME:
{
size_t len;
len = strnlen(this->buf.ptr, this->buf.len);
if (len >= this->buf.len)
{
return FALSE;
}
value->str = this->buf.ptr;
*attr_out = attr;
this->buf = chunk_skip(this->buf, len + 1);
return TRUE;
}
/* u_int8_t */
case HA_IPSEC_MODE:
case HA_IPCOMP:
{
if (this->buf.len < sizeof(u_int8_t))
{
return FALSE;
}
value->u8 = *(u_int8_t*)this->buf.ptr;
*attr_out = attr;
this->buf = chunk_skip(this->buf, sizeof(u_int8_t));
return TRUE;
}
/** u_int16_t */
case HA_ALG_PRF:
case HA_ALG_OLD_PRF:
case HA_ALG_ENCR:
case HA_ALG_ENCR_LEN:
case HA_ALG_INTEG:
case HA_INBOUND_CPI:
case HA_OUTBOUND_CPI:
case HA_SEGMENT:
{
if (this->buf.len < sizeof(u_int16_t))
{
return FALSE;
}
value->u16 = ntohs(*(u_int16_t*)this->buf.ptr);
*attr_out = attr;
this->buf = chunk_skip(this->buf, sizeof(u_int16_t));
return TRUE;
}
/** u_int32_t */
case HA_CONDITIONS:
case HA_EXTENSIONS:
case HA_INBOUND_SPI:
case HA_OUTBOUND_SPI:
case HA_INITIATE_MID:
case HA_RESPOND_MID:
{
if (this->buf.len < sizeof(u_int32_t))
{
return FALSE;
}
value->u32 = ntohl(*(u_int32_t*)this->buf.ptr);
*attr_out = attr;
this->buf = chunk_skip(this->buf, sizeof(u_int32_t));
return TRUE;
}
/** chunk_t */
case HA_NONCE_I:
case HA_NONCE_R:
case HA_SECRET:
case HA_OLD_SKD:
{
size_t len;
if (this->buf.len < sizeof(u_int16_t))
{
return FALSE;
}
len = ntohs(*(u_int16_t*)this->buf.ptr);
this->buf = chunk_skip(this->buf, sizeof(u_int16_t));
if (this->buf.len < len)
{
return FALSE;
}
value->chunk.len = len;
value->chunk.ptr = this->buf.ptr;
*attr_out = attr;
this->buf = chunk_skip(this->buf, len);
return TRUE;
}
case HA_LOCAL_TS:
case HA_REMOTE_TS:
{
ts_encoding_t *enc;
host_t *host;
int addr_len;
enc = (ts_encoding_t*)(this->buf.ptr);
if (this->buf.len < sizeof(ts_encoding_t))
{
return FALSE;
}
switch (enc->type)
{
case TS_IPV4_ADDR_RANGE:
addr_len = 4;
if (this->buf.len < sizeof(ts_encoding_t) + 2 * addr_len)
{
return FALSE;
}
break;
case TS_IPV6_ADDR_RANGE:
addr_len = 16;
if (this->buf.len < sizeof(ts_encoding_t) + 2 * addr_len)
{
return FALSE;
}
break;
default:
return FALSE;
}
if (enc->dynamic)
{
host = host_create_from_chunk(0,
chunk_create(enc->encoding, addr_len), 0);
if (!host)
{
return FALSE;
}
value->ts = traffic_selector_create_dynamic(enc->protocol,
ntohs(enc->from_port), ntohs(enc->to_port));
value->ts->set_address(value->ts, host);
host->destroy(host);
}
else
{
value->ts = traffic_selector_create_from_bytes(enc->protocol,
enc->type, chunk_create(enc->encoding, addr_len),
ntohs(enc->from_port),
chunk_create(enc->encoding + addr_len, addr_len),
ntohs(enc->to_port));
if (!value->ts)
{
return FALSE;
}
}
*attr_out = attr;
this->cleanup = (void*)value->ts->destroy;
this->cleanup_data = value->ts;
this->buf = chunk_skip(this->buf, sizeof(ts_encoding_t)
+ addr_len * 2);
return TRUE;
}
default:
{
return FALSE;
}
}
}
/**
* Implementation of create_attribute_enumerator().destroy
*/
static void enum_destroy(attribute_enumerator_t *this)
{
if (this->cleanup)
{
this->cleanup(this->cleanup_data);
}
free(this);
}
/**
* Implementation of ha_message_t.create_attribute_enumerator
*/
static enumerator_t* create_attribute_enumerator(private_ha_message_t *this)
{
attribute_enumerator_t *e = malloc_thing(attribute_enumerator_t);
e->public.enumerate = (void*)attribute_enumerate;
e->public.destroy = (void*)enum_destroy;
e->buf = chunk_skip(this->buf, 2);
e->cleanup = NULL;
e->cleanup_data = NULL;
return &e->public;
}
/**
* Implementation of ha_message_t.get_encoding
*/
static chunk_t get_encoding(private_ha_message_t *this)
{
return this->buf;
}
/**
* Implementation of ha_message_t.destroy.
*/
static void destroy(private_ha_message_t *this)
{
free(this->buf.ptr);
free(this);
}
static private_ha_message_t *ha_message_create_generic()
{
private_ha_message_t *this = malloc_thing(private_ha_message_t);
this->public.get_type = (ha_message_type_t(*)(ha_message_t*))get_type;
this->public.add_attribute = (void(*)(ha_message_t*, ha_message_attribute_t attribute, ...))add_attribute;
this->public.create_attribute_enumerator = (enumerator_t*(*)(ha_message_t*))create_attribute_enumerator;
this->public.get_encoding = (chunk_t(*)(ha_message_t*))get_encoding;
this->public.destroy = (void(*)(ha_message_t*))destroy;
return this;
}
/**
* See header
*/
ha_message_t *ha_message_create(ha_message_type_t type)
{
private_ha_message_t *this = ha_message_create_generic();
this->allocated = ALLOCATION_BLOCK;
this->buf.ptr = malloc(this->allocated);
this->buf.len = 2;
this->buf.ptr[0] = HA_MESSAGE_VERSION;
this->buf.ptr[1] = type;
return &this->public;
}
/**
* See header
*/
ha_message_t *ha_message_parse(chunk_t data)
{
private_ha_message_t *this;
if (data.len < 2)
{
DBG1(DBG_CFG, "HA message too short");
return NULL;
}
if (data.ptr[0] != HA_MESSAGE_VERSION)
{
DBG1(DBG_CFG, "HA message has version %d, expected %d",
data.ptr[0], HA_MESSAGE_VERSION);
return NULL;
}
this = ha_message_create_generic();
this->buf = chunk_clone(data);
this->allocated = this->buf.len;
return &this->public;
}
src/charon/plugins/ha/ha_message.h
-207
View File
@@ -1,207 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha_message ha_message
* @{ @ingroup ha
*/
#ifndef HA_MESSAGE_H_
#define HA_MESSAGE_H_
#include <library.h>
#include <utils/host.h>
#include <utils/identification.h>
#include <sa/ike_sa_id.h>
#include <config/traffic_selector.h>
/**
* Protocol version of this implementation
*/
#define HA_MESSAGE_VERSION 1
typedef struct ha_message_t ha_message_t;
typedef enum ha_message_type_t ha_message_type_t;
typedef enum ha_message_attribute_t ha_message_attribute_t;
typedef union ha_message_value_t ha_message_value_t;
/**
* Type of a HA message
*/
enum ha_message_type_t {
/** add a completely new IKE_SA */
HA_IKE_ADD = 1,
/** update an existing IKE_SA (message IDs, address update, ...) */
HA_IKE_UPDATE,
/** delete an existing IKE_SA */
HA_IKE_DELETE,
/** add a new CHILD_SA */
HA_CHILD_ADD,
/** delete an existing CHILD_SA */
HA_CHILD_DELETE,
/** segments the sending node is giving up */
HA_SEGMENT_DROP,
/** segments the sending node is taking over */
HA_SEGMENT_TAKE,
/** status with the segments the sending node is currently serving */
HA_STATUS,
/** segments the receiving node is requested to resync */
HA_RESYNC,
};
/**
* Type of attributes contained in a message
*/
enum ha_message_attribute_t {
/** ike_sa_id_t*, to identify IKE_SA */
HA_IKE_ID = 1,
/** ike_Sa_id_t*, identifies IKE_SA which gets rekeyed */
HA_IKE_REKEY_ID,
/** identification_t*, local identity */
HA_LOCAL_ID,
/** identification_t*, remote identity */
HA_REMOTE_ID,
/** identification_t*, EAP identity */
HA_EAP_ID,
/** host_t*, local address */
HA_LOCAL_ADDR,
/** host_t*, remote address */
HA_REMOTE_ADDR,
/** char*, name of configuration */
HA_CONFIG_NAME,
/** u_int32_t, bitset of ike_condition_t */
HA_CONDITIONS,
/** u_int32_t, bitset of ike_extension_t */
HA_EXTENSIONS,
/** host_t*, local virtual IP */
HA_LOCAL_VIP,
/** host_t*, remote virtual IP */
HA_REMOTE_VIP,
/** host_t*, additional MOBIKE peer address */
HA_ADDITIONAL_ADDR,
/** chunk_t, initiators nonce */
HA_NONCE_I,
/** chunk_t, responders nonce */
HA_NONCE_R,
/** chunk_t, diffie hellman shared secret */
HA_SECRET,
/** chunk_t, SKd of old SA if rekeying */
HA_OLD_SKD,
/** u_int16_t, pseudo random function */
HA_ALG_PRF,
/** u_int16_t, old pseudo random function if rekeying */
HA_ALG_OLD_PRF,
/** u_int16_t, encryption algorithm */
HA_ALG_ENCR,
/** u_int16_t, encryption key size in bytes */
HA_ALG_ENCR_LEN,
/** u_int16_t, integrity protection algorithm */
HA_ALG_INTEG,
/** u_int8_t, IPsec mode, TUNNEL|TRANSPORT|... */
HA_IPSEC_MODE,
/** u_int8_t, IPComp protocol */
HA_IPCOMP,
/** u_int32_t, inbound security parameter index */
HA_INBOUND_SPI,
/** u_int32_t, outbound security parameter index */
HA_OUTBOUND_SPI,
/** u_int16_t, inbound security parameter index */
HA_INBOUND_CPI,
/** u_int16_t, outbound security parameter index */
HA_OUTBOUND_CPI,
/** traffic_selector_t*, local traffic selector */
HA_LOCAL_TS,
/** traffic_selector_t*, remote traffic selector */
HA_REMOTE_TS,
/** u_int32_t, initiating message ID */
HA_INITIATE_MID,
/** u_int32_t, responding message ID */
HA_RESPOND_MID,
/** u_int16_t, HA segment */
HA_SEGMENT,
};
/**
* Union to enumerate typed attributes in a message
*/
union ha_message_value_t {
u_int8_t u8;
u_int16_t u16;
u_int32_t u32;
char *str;
chunk_t chunk;
ike_sa_id_t *ike_sa_id;
identification_t *id;
host_t *host;
traffic_selector_t *ts;
};
/**
* Abstracted message passed between nodes in a HA cluster.
*/
struct ha_message_t {
/**
* Get the type of the message.
*
* @return message type
*/
ha_message_type_t (*get_type)(ha_message_t *this);
/**
* Add an attribute to a message.
*
* @param attribute attribute type to add
* @param ... attribute specific data
*/
void (*add_attribute)(ha_message_t *this,
ha_message_attribute_t attribute, ...);
/**
* Create an enumerator over all attributes in a message.
*
* @return enumerator over attribute, ha_message_value_t
*/
enumerator_t* (*create_attribute_enumerator)(ha_message_t *this);
/**
* Get the message in a encoded form.
*
* @return chunk pointing to internal data
*/
chunk_t (*get_encoding)(ha_message_t *this);
/**
* Destroy a ha_message_t.
*/
void (*destroy)(ha_message_t *this);
};
/**
* Create a new ha_message instance, ready for adding attributes
*
* @param version protocol version to create a message from
* @param type type of the message
*/
ha_message_t *ha_message_create(ha_message_type_t type);
/**
* Create a ha_message from encoded data.
*
* @param data encoded message data
*/
ha_message_t *ha_message_parse(chunk_t data);
#endif /* HA_MESSAGE_ @}*/
src/charon/plugins/ha/ha_plugin.c
-163
View File
@@ -1,163 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ha_plugin.h"
#include "ha_ike.h"
#include "ha_child.h"
#include "ha_socket.h"
#include "ha_tunnel.h"
#include "ha_dispatcher.h"
#include "ha_segments.h"
#include "ha_ctl.h"
#include <daemon.h>
#include <config/child_cfg.h>
typedef struct private_ha_plugin_t private_ha_plugin_t;
/**
* private data of ha plugin
*/
struct private_ha_plugin_t {
/**
* implements plugin interface
*/
ha_plugin_t public;
/**
* Communication socket
*/
ha_socket_t *socket;
/**
* Tunnel securing sync messages.
*/
ha_tunnel_t *tunnel;
/**
* IKE_SA synchronization
*/
ha_ike_t *ike;
/**
* CHILD_SA synchronization
*/
ha_child_t *child;
/**
* Dispatcher to process incoming messages
*/
ha_dispatcher_t *dispatcher;
/**
* Active/Passive segment management
*/
ha_segments_t *segments;
/**
* Interface to control segments at kernel level
*/
ha_kernel_t *kernel;
/**
* Segment control interface via FIFO
*/
ha_ctl_t *ctl;
};
/**
* Implementation of plugin_t.destroy
*/
static void destroy(private_ha_plugin_t *this)
{
DESTROY_IF(this->ctl);
charon->bus->remove_listener(charon->bus, &this->segments->listener);
charon->bus->remove_listener(charon->bus, &this->ike->listener);
charon->bus->remove_listener(charon->bus, &this->child->listener);
this->ike->destroy(this->ike);
this->child->destroy(this->child);
this->dispatcher->destroy(this->dispatcher);
this->segments->destroy(this->segments);
this->kernel->destroy(this->kernel);
this->socket->destroy(this->socket);
DESTROY_IF(this->tunnel);
free(this);
}
/*
* see header file
*/
plugin_t *plugin_create()
{
private_ha_plugin_t *this;
char *local, *remote, *secret;
u_int count;
bool fifo, monitor, resync;
local = lib->settings->get_str(lib->settings,
"charon.plugins.ha.local", NULL);
remote = lib->settings->get_str(lib->settings,
"charon.plugins.ha.remote", NULL);
secret = lib->settings->get_str(lib->settings,
"charon.plugins.ha.secret", NULL);
fifo = lib->settings->get_bool(lib->settings,
"charon.plugins.ha.fifo_interface", TRUE);
monitor = lib->settings->get_bool(lib->settings,
"charon.plugins.ha.monitor", TRUE);
resync = lib->settings->get_bool(lib->settings,
"charon.plugins.ha.resync", TRUE);
count = min(SEGMENTS_MAX, lib->settings->get_int(lib->settings,
"charon.plugins.ha.segment_count", 1));
if (!local || !remote)
{
DBG1(DBG_CFG, "HA config misses local/remote address");
return NULL;
}
this = malloc_thing(private_ha_plugin_t);
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
this->tunnel = NULL;
this->ctl = NULL;
if (secret)
{
this->tunnel = ha_tunnel_create(local, remote, secret);
}
this->socket = ha_socket_create(local, remote);
if (!this->socket)
{
DESTROY_IF(this->tunnel);
free(this);
return NULL;
}
this->kernel = ha_kernel_create(count);
this->segments = ha_segments_create(this->socket, this->kernel, this->tunnel,
count, strcmp(local, remote) > 0, monitor, resync);
if (fifo)
{
this->ctl = ha_ctl_create(this->segments);
}
this->dispatcher = ha_dispatcher_create(this->socket, this->segments);
this->ike = ha_ike_create(this->socket, this->tunnel);
this->child = ha_child_create(this->socket, this->tunnel);
charon->bus->add_listener(charon->bus, &this->segments->listener);
charon->bus->add_listener(charon->bus, &this->ike->listener);
charon->bus->add_listener(charon->bus, &this->child->listener);
return &this->public.plugin;
}
src/charon/plugins/ha/ha_plugin.h
-52
View File
@@ -1,52 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha ha
* @ingroup cplugins
*
* @defgroup ha_plugin ha_plugin
* @{ @ingroup ha
*/
#ifndef HA_PLUGIN_H_
#define HA_PLUGIN_H_
#include <plugins/plugin.h>
/**
* UDP port we use for communication
*/
#define HA_PORT 4510
typedef struct ha_plugin_t ha_plugin_t;
/**
* Plugin to synchronize state in a high availability cluster.
*/
struct ha_plugin_t {
/**
* implements plugin interface
*/
plugin_t plugin;
};
/**
* Create a ha_plugin instance.
*/
plugin_t *plugin_create();
#endif /* HA_PLUGIN_H_ @}*/
src/charon/plugins/ha/ha_segments.c
-502
View File
@@ -1,502 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ha_segments.h"
#include <pthread.h>
#include <utils/mutex.h>
#include <utils/linked_list.h>
#include <processing/jobs/callback_job.h>
#define HEARTBEAT_DELAY 1000
#define HEARTBEAT_TIMEOUT 2100
typedef struct private_ha_segments_t private_ha_segments_t;
/**
* Private data of an ha_segments_t object.
*/
struct private_ha_segments_t {
/**
* Public ha_segments_t interface.
*/
ha_segments_t public;
/**
* communication socket
*/
ha_socket_t *socket;
/**
* Sync tunnel, if any
*/
ha_tunnel_t *tunnel;
/**
* Interface to control segments at kernel level
*/
ha_kernel_t *kernel;
/**
* Mutex to lock segment manipulation
*/
mutex_t *mutex;
/**
* Condvar to wait for heartbeats
*/
condvar_t *condvar;
/**
* Job checking for heartbeats
*/
callback_job_t *job;
/**
* Total number of ClusterIP segments
*/
u_int count;
/**
* mask of active segments
*/
segment_mask_t active;
/**
* Node number
*/
u_int node;
};
/**
* Log currently active segments
*/
static void log_segments(private_ha_segments_t *this, bool activated,
u_int segment)
{
char buf[64] = "none", *pos = buf;
int i;
bool first = TRUE;
for (i = 1; i <= this->count; i++)
{
if (this->active & SEGMENTS_BIT(i))
{
if (first)
{
first = FALSE;
}
else
{
pos += snprintf(pos, buf + sizeof(buf) - pos, ",");
}
pos += snprintf(pos, buf + sizeof(buf) - pos, "%d", i);
}
}
DBG1(DBG_CFG, "HA segment %d %sactivated, now active: %s",
segment, activated ? "" : "de", buf);
}
/**
* Enable/Disable a specific segment
*/
static void enable_disable(private_ha_segments_t *this, u_int segment,
bool enable, bool notify)
{
ike_sa_t *ike_sa;
enumerator_t *enumerator;
ike_sa_state_t old, new;
ha_message_t *message = NULL;
ha_message_type_t type;
bool changes = FALSE;
if (segment > this->count)
{
return;
}
if (enable)
{
old = IKE_PASSIVE;
new = IKE_ESTABLISHED;
type = HA_SEGMENT_TAKE;
if (!(this->active & SEGMENTS_BIT(segment)))
{
this->active |= SEGMENTS_BIT(segment);
this->kernel->activate(this->kernel, segment);
changes = TRUE;
}
}
else
{
old = IKE_ESTABLISHED;
new = IKE_PASSIVE;
type = HA_SEGMENT_DROP;
if (this->active & SEGMENTS_BIT(segment))
{
this->active &= ~SEGMENTS_BIT(segment);
this->kernel->deactivate(this->kernel, segment);
changes = TRUE;
}
}
if (changes)
{
enumerator = charon->ike_sa_manager->create_enumerator(charon->ike_sa_manager);
while (enumerator->enumerate(enumerator, &ike_sa))
{
if (ike_sa->get_state(ike_sa) != old)
{
continue;
}
if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
{
continue;
}
if (this->kernel->in_segment(this->kernel,
ike_sa->get_other_host(ike_sa), segment))
{
ike_sa->set_state(ike_sa, new);
}
}
enumerator->destroy(enumerator);
log_segments(this, enable, segment);
}
if (notify)
{
message = ha_message_create(type);
message->add_attribute(message, HA_SEGMENT, segment);
this->socket->push(this->socket, message);
}
}
/**
* Enable/Disable all or a specific segment, do locking
*/
static void enable_disable_all(private_ha_segments_t *this, u_int segment,
bool enable, bool notify)
{
int i;
this->mutex->lock(this->mutex);
if (segment == 0)
{
for (i = 1; i <= this->count; i++)
{
enable_disable(this, i, enable, notify);
}
}
else
{
enable_disable(this, segment, enable, notify);
}
this->mutex->unlock(this->mutex);
}
/**
* Implementation of ha_segments_t.activate
*/
static void activate(private_ha_segments_t *this, u_int segment, bool notify)
{
enable_disable_all(this, segment, TRUE, notify);
}
/**
* Implementation of ha_segments_t.deactivate
*/
static void deactivate(private_ha_segments_t *this, u_int segment, bool notify)
{
enable_disable_all(this, segment, FALSE, notify);
}
/**
* Rekey all children of an IKE_SA
*/
static status_t rekey_children(ike_sa_t *ike_sa)
{
iterator_t *iterator;
child_sa_t *child_sa;
status_t status = SUCCESS;
iterator = ike_sa->create_child_sa_iterator(ike_sa);
while (iterator->iterate(iterator, (void**)&child_sa))
{
DBG1(DBG_CFG, "resyncing CHILD_SA");
status = ike_sa->rekey_child_sa(ike_sa, child_sa->get_protocol(child_sa),
child_sa->get_spi(child_sa, TRUE));
if (status == DESTROY_ME)
{
break;
}
}
iterator->destroy(iterator);
return status;
}
/**
* Implementation of ha_segments_t.resync
*/
static void resync(private_ha_segments_t *this, u_int segment)
{
ike_sa_t *ike_sa;
enumerator_t *enumerator;
linked_list_t *list;
ike_sa_id_t *id;
list = linked_list_create();
this->mutex->lock(this->mutex);
if (segment > 0 && segment <= this->count)
{
DBG1(DBG_CFG, "resyncing HA segment %d", segment);
/* we do the actual rekeying in a seperate loop to avoid rekeying
* an SA twice. */
enumerator = charon->ike_sa_manager->create_enumerator(
charon->ike_sa_manager);
while (enumerator->enumerate(enumerator, &ike_sa))
{
if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
this->kernel->in_segment(this->kernel,
ike_sa->get_other_host(ike_sa), segment))
{
id = ike_sa->get_id(ike_sa);
list->insert_last(list, id->clone(id));
}
}
enumerator->destroy(enumerator);
}
this->mutex->unlock(this->mutex);
while (list->remove_last(list, (void**)&id) == SUCCESS)
{
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, id);
id->destroy(id);
if (ike_sa)
{
DBG1(DBG_CFG, "resyncing IKE_SA");
if (ike_sa->rekey(ike_sa) != DESTROY_ME)
{
if (rekey_children(ike_sa) != DESTROY_ME)
{
charon->ike_sa_manager->checkin(
charon->ike_sa_manager, ike_sa);
continue;
}
}
charon->ike_sa_manager->checkin_and_destroy(
charon->ike_sa_manager, ike_sa);
}
}
list->destroy(list);
}
/**
* Implementation of listener_t.alert
*/
static bool alert_hook(private_ha_segments_t *this, ike_sa_t *ike_sa,
alert_t alert, va_list args)
{
if (alert == ALERT_SHUTDOWN_SIGNAL)
{
deactivate(this, 0, TRUE);
}
return TRUE;
}
/**
* Request a resync of all segments
*/
static job_requeue_t request_resync(private_ha_segments_t *this)
{
ha_message_t *message;
int i;
message = ha_message_create(HA_RESYNC);
for (i = 1; i <= this->count; i++)
{
message->add_attribute(message, HA_SEGMENT, i);
}
this->socket->push(this->socket, message);
return JOB_REQUEUE_NONE;
}
/**
* Monitor heartbeat activity of remote node
*/
static job_requeue_t watchdog(private_ha_segments_t *this)
{
int oldstate;
bool timeout;
this->mutex->lock(this->mutex);
pthread_cleanup_push((void*)this->mutex->unlock, this->mutex);
pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
timeout = this->condvar->timed_wait(this->condvar, this->mutex,
HEARTBEAT_TIMEOUT);
pthread_setcancelstate(oldstate, NULL);
pthread_cleanup_pop(TRUE);
if (timeout)
{
DBG1(DBG_CFG, "no heartbeat received, taking all segments");
activate(this, 0, TRUE);
/* disable heartbeat detection util we get one */
this->job = NULL;
return JOB_REQUEUE_NONE;
}
return JOB_REQUEUE_DIRECT;
}
/**
* Start the heartbeat detection thread
*/
static void start_watchdog(private_ha_segments_t *this)
{
this->job = callback_job_create((callback_job_cb_t)watchdog,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
}
/**
* Implementation of ha_segments_t.handle_status
*/
static void handle_status(private_ha_segments_t *this, segment_mask_t mask)
{
segment_mask_t missing;
int i;
this->mutex->lock(this->mutex);
missing = ~(this->active | mask);
for (i = 1; i <= this->count; i++)
{
if (missing & SEGMENTS_BIT(i))
{
if (this->node == i % 2)
{
DBG1(DBG_CFG, "HA segment %d was not handled, taking", i);
enable_disable(this, i, TRUE, TRUE);
}
else
{
DBG1(DBG_CFG, "HA segment %d was not handled, dropping", i);
enable_disable(this, i, FALSE, TRUE);
}
}
}
this->mutex->unlock(this->mutex);
this->condvar->signal(this->condvar);
if (!this->job)
{
DBG1(DBG_CFG, "received heartbeat, reenabling watchdog");
start_watchdog(this);
}
}
/**
* Send a status message with our active segments
*/
static job_requeue_t send_status(private_ha_segments_t *this)
{
ha_message_t *message;
int i;
message = ha_message_create(HA_STATUS);
for (i = 1; i <= this->count; i++)
{
if (this->active & SEGMENTS_BIT(i))
{
message->add_attribute(message, HA_SEGMENT, i);
}
}
this->socket->push(this->socket, message);
/* schedule next invocation */
charon->scheduler->schedule_job_ms(charon->scheduler, (job_t*)
callback_job_create((callback_job_cb_t)
send_status, this, NULL, NULL),
HEARTBEAT_DELAY);
return JOB_REQUEUE_NONE;
}
/**
* Implementation of ha_segments_t.destroy.
*/
static void destroy(private_ha_segments_t *this)
{
if (this->job)
{
this->job->cancel(this->job);
}
this->mutex->destroy(this->mutex);
this->condvar->destroy(this->condvar);
free(this);
}
/**
* See header
*/
ha_segments_t *ha_segments_create(ha_socket_t *socket, ha_kernel_t *kernel,
ha_tunnel_t *tunnel, u_int count, u_int node,
bool monitor, bool sync)
{
private_ha_segments_t *this = malloc_thing(private_ha_segments_t);
memset(&this->public.listener, 0, sizeof(listener_t));
this->public.listener.alert = (bool(*)(listener_t*, ike_sa_t *, alert_t, va_list))alert_hook;
this->public.activate = (void(*)(ha_segments_t*, u_int segment,bool))activate;
this->public.deactivate = (void(*)(ha_segments_t*, u_int segment,bool))deactivate;
this->public.resync = (void(*)(ha_segments_t*, u_int segment))resync;
this->public.handle_status = (void(*)(ha_segments_t*, segment_mask_t mask))handle_status;
this->public.destroy = (void(*)(ha_segments_t*))destroy;
this->socket = socket;
this->tunnel = tunnel;
this->kernel = kernel;
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
this->condvar = condvar_create(CONDVAR_TYPE_DEFAULT);
this->count = count;
this->node = node;
this->job = NULL;
/* initially all segments are deactivated */
this->active = 0;
if (monitor)
{
send_status(this);
start_watchdog(this);
}
if (sync)
{
/* request a resync as soon as we are up */
charon->processor->queue_job(charon->processor, (job_t*)
callback_job_create((callback_job_cb_t)request_resync,
this, NULL, NULL));
}
return &this->public;
}
src/charon/plugins/ha/ha_segments.h
-111
View File
@@ -1,111 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha_segments ha_segments
* @{ @ingroup ha
*/
#ifndef HA_SEGMENTS_H_
#define HA_SEGMENTS_H_
#include <daemon.h>
typedef struct ha_segments_t ha_segments_t;
typedef u_int16_t segment_mask_t;
/**
* maximum number of segments
*/
#define SEGMENTS_MAX (sizeof(segment_mask_t)*8)
/**
* Get the bit in the mask of a segment
*/
#define SEGMENTS_BIT(segment) (0x01 << (segment - 1))
#include "ha_socket.h"
#include "ha_tunnel.h"
#include "ha_kernel.h"
/**
* Segmentation of peers into active and passive.
*/
struct ha_segments_t {
/**
* Implements listener interface to catch daemon shutdown.
*/
listener_t listener;
/**
* Activate a set of IKE_SAs identified by a segment.
*
* @param segment numerical segment to takeover, 0 for all
* @param notify wheter to notify other nodes about activation
*/
void (*activate)(ha_segments_t *this, u_int segment, bool notify);
/**
* Deactivate a set of IKE_SAs identified by a segment.
*
* @param segment numerical segment to takeover, 0 for all
* @param notify wheter to notify other nodes about deactivation
*/
void (*deactivate)(ha_segments_t *this, u_int segment, bool notify);
/**
* Resync an active segment.
*
* To reintegrade a node into the cluster, resynchronization is reqired.
* IKE_SAs and CHILD_SAs are synced automatically during rekeying. A call
* to this method enforces a rekeying immediately sync all state of a
* segment.
*
* @param segment segment to resync
*/
void (*resync)(ha_segments_t *this, u_int segment);
/**
* Handle a status message from the remote node.
*
* @param mask segments the remote node is serving actively
*/
void (*handle_status)(ha_segments_t *this, segment_mask_t mask);
/**
* Destroy a ha_segments_t.
*/
void (*destroy)(ha_segments_t *this);
};
/**
* Create a ha_segments instance.
*
* @param socket socket to communicate segment (de-)activation
* @param kernel interface to control segments at kernel level
* @param tunnel HA tunnel
* @param count number of segments the cluster uses
* @param node node, currently 1 or 0
* @param monitor should we use monitoring functionality
* @param resync request a complete resync on startup
* @return segment object
*/
ha_segments_t *ha_segments_create(ha_socket_t *socket, ha_kernel_t *kernel,
ha_tunnel_t *tunnel, u_int count, u_int node,
bool monitor, bool resync);
#endif /* HA_SEGMENTS_ @}*/
src/charon/plugins/ha/ha_socket.c
-234
View File
@@ -1,234 +0,0 @@
/*
* Copyright (C) 2008-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ha_socket.h"
#include "ha_plugin.h"
#include <sys/types.h>
#include <sys/socket.h>
#include <errno.h>
#include <unistd.h>
#include <pthread.h>
#include <daemon.h>
#include <utils/host.h>
#include <processing/jobs/callback_job.h>
typedef struct private_ha_socket_t private_ha_socket_t;
/**
* Private data of an ha_socket_t object.
*/
struct private_ha_socket_t {
/**
* Public ha_socket_t interface.
*/
ha_socket_t public;
/**
* UDP communication socket fd
*/
int fd;
/**
* local host to receive/send from
*/
host_t *local;
/**
* remote host to receive/send to
*/
host_t *remote;
};
/**
* Data to pass to the send_message() callback job
*/
typedef struct {
ha_message_t *message;
private_ha_socket_t *this;
} job_data_t;
/**
* Cleanup job data
*/
static void job_data_destroy(job_data_t *this)
{
this->message->destroy(this->message);
free(this);
}
/**
* Callback to asynchronously send messages
*/
static job_requeue_t send_message(job_data_t *data)
{
private_ha_socket_t *this;
chunk_t chunk;
this = data->this;
chunk = data->message->get_encoding(data->message);
if (send(this->fd, chunk.ptr, chunk.len, 0) < chunk.len)
{
DBG1(DBG_CFG, "pushing HA message failed: %s", strerror(errno));
}
return JOB_REQUEUE_NONE;
}
/**
* Implementation of ha_socket_t.push
*/
static void push(private_ha_socket_t *this, ha_message_t *message)
{
chunk_t chunk;
/* Try to send synchronously, but non-blocking. */
chunk = message->get_encoding(message);
if (send(this->fd, chunk.ptr, chunk.len, MSG_DONTWAIT) < chunk.len)
{
if (errno == EAGAIN)
{
callback_job_t *job;
job_data_t *data;
/* Fallback to asynchronous transmission. This is required, as sendto()
* is a blocking call if it acquires a policy. We could end up in a
* deadlock, as we own an IKE_SA. */
data = malloc_thing(job_data_t);
data->message = message;
data->this = this;
job = callback_job_create((callback_job_cb_t)send_message,
data, (void*)job_data_destroy, NULL);
charon->processor->queue_job(charon->processor, (job_t*)job);
return;
}
DBG1(DBG_CFG, "pushing HA message failed: %s", strerror(errno));
}
message->destroy(message);
}
/**
* Implementation of ha_socket_t.pull
*/
static ha_message_t *pull(private_ha_socket_t *this)
{
while (TRUE)
{
ha_message_t *message;
char buf[1024];
int oldstate;
ssize_t len;
pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
len = recv(this->fd, buf, sizeof(buf), 0);
pthread_setcancelstate(oldstate, NULL);
if (len <= 0)
{
switch (errno)
{
case ECONNREFUSED:
case EINTR:
continue;
default:
DBG1(DBG_CFG, "pulling HA message failed: %s",
strerror(errno));
sleep(1);
}
}
message = ha_message_parse(chunk_create(buf, len));
if (message)
{
return message;
}
}
}
/**
* Open and connect the HA socket
*/
static bool open_socket(private_ha_socket_t *this)
{
this->fd = socket(this->local->get_family(this->local), SOCK_DGRAM, 0);
if (this->fd == -1)
{
DBG1(DBG_CFG, "opening HA socket failed: %s", strerror(errno));
return FALSE;
}
if (bind(this->fd, this->local->get_sockaddr(this->local),
*this->local->get_sockaddr_len(this->local)) == -1)
{
DBG1(DBG_CFG, "binding HA socket failed: %s", strerror(errno));
close(this->fd);
this->fd = -1;
return FALSE;
}
if (connect(this->fd, this->remote->get_sockaddr(this->remote),
*this->remote->get_sockaddr_len(this->remote)) == -1)
{
DBG1(DBG_CFG, "connecting HA socket failed: %s", strerror(errno));
close(this->fd);
this->fd = -1;
return FALSE;
}
return TRUE;
}
/**
* Implementation of ha_socket_t.destroy.
*/
static void destroy(private_ha_socket_t *this)
{
if (this->fd != -1)
{
close(this->fd);
}
DESTROY_IF(this->local);
DESTROY_IF(this->remote);
free(this);
}
/**
* See header
*/
ha_socket_t *ha_socket_create(char *local, char *remote)
{
private_ha_socket_t *this = malloc_thing(private_ha_socket_t);
this->public.push = (void(*)(ha_socket_t*, ha_message_t*))push;
this->public.pull = (ha_message_t*(*)(ha_socket_t*))pull;
this->public.destroy = (void(*)(ha_socket_t*))destroy;
this->local = host_create_from_dns(local, 0, HA_PORT);
this->remote = host_create_from_dns(remote, 0, HA_PORT);
this->fd = -1;
if (!this->local || !this->remote)
{
DBG1(DBG_CFG, "invalid local/remote HA address");
destroy(this);
return NULL;
}
if (!open_socket(this))
{
destroy(this);
return NULL;
}
return &this->public;
}
src/charon/plugins/ha/ha_socket.h
-60
View File
@@ -1,60 +0,0 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha_socket ha_socket
* @{ @ingroup ha
*/
#ifndef HA_SOCKET_H_
#define HA_SOCKET_H_
#include "ha_message.h"
#include <sa/ike_sa.h>
typedef struct ha_socket_t ha_socket_t;
/**
* Socket to send/received SA synchronization data
*/
struct ha_socket_t {
/**
* Push synchronization information to the responsible node.
*
* @param message message to send, gets destroyed by push()
*/
void (*push)(ha_socket_t *this, ha_message_t *message);
/**
* Pull synchronization information from a peer we are responsible.
*
* @return received message
*/
ha_message_t *(*pull)(ha_socket_t *this);
/**
* Destroy a ha_socket_t.
*/
void (*destroy)(ha_socket_t *this);
};
/**
* Create a ha_socket instance.
*/
ha_socket_t *ha_socket_create(char *local, char *remote);
#endif /* HA_SOCKET_ @}*/
src/charon/plugins/ha/ha_tunnel.c
-297
View File
@@ -1,297 +0,0 @@
/*
* Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ha_tunnel.h"
#include "ha_plugin.h"
#include <daemon.h>
#include <utils/identification.h>
#include <processing/jobs/callback_job.h>
typedef struct private_ha_tunnel_t private_ha_tunnel_t;
typedef struct ha_backend_t ha_backend_t;
typedef struct ha_creds_t ha_creds_t;
/**
* Serves credentials for the HA SA
*/
struct ha_creds_t {
/**
* Implements credential_set_t
*/
credential_set_t public;
/**
* own identity
*/
identification_t *local;
/**
* peer identity
*/
identification_t *remote;
/**
* Shared key to serve
*/
shared_key_t *key;
};
/**
* Serves configurations for the HA SA
*/
struct ha_backend_t {
/**
* Implements backend_t
*/
backend_t public;
/**
* peer config we serve
*/
peer_cfg_t *cfg;
};
/**
* Private data of an ha_tunnel_t object.
*/
struct private_ha_tunnel_t {
/**
* Public ha_tunnel_t interface.
*/
ha_tunnel_t public;
/**
* Reqid of installed trap
*/
u_int32_t trap;
/**
* backend for HA SA
*/
ha_backend_t backend;
/**
* credential set for HA SA
*/
ha_creds_t creds;
};
/**
* Implementation of ha_tunnel_t.is_sa
*/
static bool is_sa(private_ha_tunnel_t *this, ike_sa_t *ike_sa)
{
peer_cfg_t *cfg = this->backend.cfg;
return cfg && ike_sa->get_ike_cfg(ike_sa) == cfg->get_ike_cfg(cfg);
}
/**
* Enumerator over HA shared_key
*/
typedef struct {
/** Implements enumerator_t */
enumerator_t public;
/** a single secret we serve */
shared_key_t *key;
} shared_enum_t;
/**
* Implementation of shared_enum_t.enumerate
*/
static bool shared_enumerate(shared_enum_t *this, shared_key_t **key,
id_match_t *me, id_match_t *other)
{
if (this->key)
{
if (me)
{
*me = ID_MATCH_PERFECT;
}
if (other)
{
*other = ID_MATCH_PERFECT;
}
*key = this->key;
this->key = NULL;
return TRUE;
}
return FALSE;
}
/**
* Implements ha_creds_t.create_shared_enumerator
*/
static enumerator_t* create_shared_enumerator(ha_creds_t *this,
shared_key_type_t type, identification_t *me,
identification_t *other)
{
shared_enum_t *enumerator;
if (type != SHARED_IKE && type != SHARED_ANY)
{
return NULL;
}
if (me && !me->equals(me, this->local))
{
return NULL;
}
if (other && !other->equals(other, this->remote))
{
return NULL;
}
enumerator = malloc_thing(shared_enum_t);
enumerator->public.enumerate = (void*)shared_enumerate;
enumerator->public.destroy = (void*)free;
enumerator->key = this->key;
return &enumerator->public;
}
/**
* Implementation of backend_t.create_peer_cfg_enumerator.
*/
static enumerator_t* create_peer_cfg_enumerator(ha_backend_t *this,
identification_t *me, identification_t *other)
{
return enumerator_create_single(this->cfg, NULL);
}
/**
* Implementation of backend_t.create_ike_cfg_enumerator.
*/
static enumerator_t* create_ike_cfg_enumerator(ha_backend_t *this,
host_t *me, host_t *other)
{
return enumerator_create_single(this->cfg->get_ike_cfg(this->cfg), NULL);
}
/**
* Install configs and a a trap for secured HA message exchange
*/
static void setup_tunnel(private_ha_tunnel_t *this,
char *local, char *remote, char *secret)
{
peer_cfg_t *peer_cfg;
ike_cfg_t *ike_cfg;
auth_cfg_t *auth_cfg;
child_cfg_t *child_cfg;
traffic_selector_t *ts;
lifetime_cfg_t lifetime = {
.time = {
.life = 21600, .rekey = 20400, .jitter = 400,
},
};
/* setup credentials */
this->creds.local = identification_create_from_string(local);
this->creds.remote = identification_create_from_string(remote);
this->creds.key = shared_key_create(SHARED_IKE,
chunk_clone(chunk_create(secret, strlen(secret))));
this->creds.public.create_private_enumerator = (void*)return_null;
this->creds.public.create_cert_enumerator = (void*)return_null;
this->creds.public.create_shared_enumerator = (void*)create_shared_enumerator;
this->creds.public.create_cdp_enumerator = (void*)return_null;
this->creds.public.cache_cert = (void*)nop;
charon->credentials->add_set(charon->credentials, &this->creds.public);
/* create config and backend */
ike_cfg = ike_cfg_create(FALSE, FALSE, local, remote);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
peer_cfg = peer_cfg_create("ha", 2, ike_cfg, CERT_NEVER_SEND,
UNIQUE_KEEP, 0, 86400, 0, 7200, 3600, FALSE, 30,
NULL, NULL, FALSE, NULL, NULL);
auth_cfg = auth_cfg_create();
auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
auth_cfg->add(auth_cfg, AUTH_RULE_IDENTITY,
identification_create_from_string(local));
peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, TRUE);
auth_cfg = auth_cfg_create();
auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
auth_cfg->add(auth_cfg, AUTH_RULE_IDENTITY,
identification_create_from_string(remote));
peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, FALSE);
child_cfg = child_cfg_create("ha", &lifetime, NULL, TRUE,
MODE_TRANSPORT, ACTION_NONE, ACTION_NONE, FALSE);
ts = traffic_selector_create_dynamic(IPPROTO_UDP, HA_PORT, HA_PORT);
child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
ts = traffic_selector_create_dynamic(IPPROTO_ICMP, 0, 65535);
child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
ts = traffic_selector_create_dynamic(IPPROTO_UDP, HA_PORT, HA_PORT);
child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
ts = traffic_selector_create_dynamic(IPPROTO_ICMP, 0, 65535);
child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
peer_cfg->add_child_cfg(peer_cfg, child_cfg);
this->backend.cfg = peer_cfg;
this->backend.public.create_peer_cfg_enumerator = (void*)create_peer_cfg_enumerator;
this->backend.public.create_ike_cfg_enumerator = (void*)create_ike_cfg_enumerator;
this->backend.public.get_peer_cfg_by_name = (void*)return_null;
charon->backends->add_backend(charon->backends, &this->backend.public);
/* install an acquiring trap */
this->trap = charon->traps->install(charon->traps, peer_cfg, child_cfg);
}
/**
* Implementation of ha_tunnel_t.destroy.
*/
static void destroy(private_ha_tunnel_t *this)
{
if (this->backend.cfg)
{
charon->backends->remove_backend(charon->backends, &this->backend.public);
this->backend.cfg->destroy(this->backend.cfg);
}
if (this->creds.key)
{
charon->credentials->remove_set(charon->credentials, &this->creds.public);
this->creds.key->destroy(this->creds.key);
}
this->creds.local->destroy(this->creds.local);
this->creds.remote->destroy(this->creds.remote);
if (this->trap)
{
charon->traps->uninstall(charon->traps, this->trap);
}
free(this);
}
/**
* See header
*/
ha_tunnel_t *ha_tunnel_create(char *local, char *remote, char *secret)
{
private_ha_tunnel_t *this = malloc_thing(private_ha_tunnel_t);
this->public.is_sa = (bool(*)(ha_tunnel_t*, ike_sa_t *ike_sa))is_sa;
this->public.destroy = (void(*)(ha_tunnel_t*))destroy;
setup_tunnel(this, local, remote, secret);
return &this->public;
}
src/charon/plugins/ha/ha_tunnel.h
-57
View File
@@ -1,57 +0,0 @@
/*
* Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ha_ ha_tunnel
* @{ @ingroup ha
*/
#ifndef HA_TUNNEL_H_
#define HA_TUNNEL_H_
#include <sa/ike_sa.h>
typedef struct ha_tunnel_t ha_tunnel_t;
/**
* Socket to send/received SA synchronization data
*/
struct ha_tunnel_t {
/**
* Check if an IKE_SA is used for exchanging HA messages.
*
* @param ike_Sa ike_sa to check
* @return TRUE if IKE_SA is used to secure HA messages
*/
bool (*is_sa)(ha_tunnel_t *this, ike_sa_t *ike_sa);
/**
* Destroy a ha_tunnel_t.
*/
void (*destroy)(ha_tunnel_t *this);
};
/**
* Create a ha_tunnel instance.
*
* @param local local address of HA tunnel
* @param remote remote address of HA tunnel
* @param secret PSK tunnel authentication secret
* @return HA tunnel instance
*/
ha_tunnel_t *ha_tunnel_create(char *local, char *remote, char *secret);
#endif /* HA_TUNNEL_H_ @}*/