blob: 7334405778b75ada9d6a32785b90aaef370d6822 [file] [log] [blame]
// Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <string>
#include "base/scoped_ptr.h"
#include "base/time.h"
#include "gtest/gtest_prod.h" // for FRIEND_TEST
#include "vpn-manager/service_manager.h"
class FilePath;
namespace chromeos {
class Process;
// Manages the ipsec daemon. This manager orchestrates configuring and
// launching the strongswan starter process which in turn launches the
// appropriate IKE v1 (pluto) or IKE v2 (charon) daemon.
class IpsecManager : public ServiceManager {
// Initialize the object to control IKE version |ike_version| daemon,
// connecting to the give |remote_hostname|, with given paths to
// pre-shared key file |psk_file|, server certificate authority file
// |server_ca_file|, client key file |client_key_file|, and client
// certificate file |client_cert_file|.
bool Initialize(int ike_version,
const std::string& remote_hostname,
const std::string& psk_file,
const std::string& server_ca_file,
const std::string& client_key_file,
const std::string& client_cert_file);
virtual bool Start();
virtual void Stop();
virtual int Poll();
virtual void ProcessOutput();
virtual bool IsChild(pid_t pid);
// Returns the stderr output file descriptor of our child process.
int output_fd() const { return output_fd_; }
friend class IpsecManagerTest;
FRIEND_TEST(IpsecManagerTest, CreateIpsecRunDirectory);
FRIEND_TEST(IpsecManagerTest, PollWaitIfNotUpYet);
FRIEND_TEST(IpsecManagerTest, PollTimeoutWaiting);
FRIEND_TEST(IpsecManagerTest, PollTransitionToUp);
FRIEND_TEST(IpsecManagerTest, PollNothingIfRunning);
FRIEND_TEST(IpsecManagerTestIkeV1Psk, FormatPsk);
FRIEND_TEST(IpsecManagerTestIkeV1Psk, FormatStarterConfigFile);
FRIEND_TEST(IpsecManagerTestIkeV1Psk, GetAddressesFromRemoteHost);
FRIEND_TEST(IpsecManagerTestIkeV1Psk, Start);
FRIEND_TEST(IpsecManagerTestIkeV1Psk, StartStarterAlreadyRunning);
FRIEND_TEST(IpsecManagerTestIkeV1Psk, StartStarterNotYetRunning);
FRIEND_TEST(IpsecManagerTestIkeV1Psk, WriteConfigFiles);
bool ConvertSockAddrToIPString(const struct sockaddr& socket_address,
std::string* output);
bool GetAddressesFromRemoteHost(const std::string& remote_hostname,
std::string* remote_address_text,
std::string* local_address_text);
bool FormatPsk(const FilePath& input_file, std::string* formatted);
void KillCurrentlyRunning();
bool WriteConfigFiles();
bool CreateIpsecRunDirectory();
std::string FormatStarterConfigFile();
bool StartStarter();
bool SetIpsecGroup(const FilePath& file_path);
// for testing, always return these values from
// GetAddressesFromRemoteHostname.
const char* force_local_address_;
const char* force_remote_address_;
// ipsec daemon stderr pipe file descriptor.
int output_fd_;
// IKE key exchange version to use.
int ike_version_;
// Group id of the "ipsec" group on this machine. This is the group
// that we expect the underlying IKE daemons to run as.
gid_t ipsec_group_;
// Writeable directory to which we can write configuration files for
// ipsec daemons.
std::string stateful_container_;
// Directory containing run files for ipsec that we create with
// permissions locked to ipsec group.
std::string ipsec_run_path_;
// File whose existence signifies ipsec is now up.
std::string ipsec_up_file_;
// String with which to prefix ipsec output log lines.
std::string ipsec_prefix_;
// File containing starter process's process id.
std::string starter_pid_file_;
// Remote hostname of IPsec connection.
std::string remote_host_;
// File containing the IPsec pre-shared key.
std::string psk_file_;
// File containing the server certificate authority.
std::string server_ca_file_;
// File containing the client private key.
std::string client_key_file_;
// File containing the client certificate.
std::string client_cert_file_;
// Last partial line read from output_fd_.
std::string partial_output_line_;
// Time when ipsec was started.
base::TimeTicks start_ticks_;
// IPsec starter process.
scoped_ptr<chromeos::Process> starter_;