[游戏开发]strongswan libcharon

目录

libcharon目录源文件

libcharon内模块相互关系

libcharon目录结构与描述

libcharon目录源文件

strongswan/src/libcharon

# ls
Android.mk  bus     control   daemon.h  encoding  Makefile.am  plugins     sa
attributes  config  daemon.c  debug     kernel    network      processing  tests

libcharon里主要实现了IKE的过程，为了确保每一个端的IKE_SA能够生成，每端需要相互认证。

在 strongswan/src/libcharon/sa目录下提供几种认证方式有：

ikev1?ikev2?eap?xauth

libcharon内模块相互关系

strongswan/src/libcharon/daemon.h的注释里以ikev2为例画出了数据流

      +---------------------------------+       +----------------------------+
      |           controller            |       |          config            |
      +---------------------------------+       +----------------------------+
               |      |      |                           ^     ^    ^
               V      V      V                           |     |    |

       +----------+  +-----------+   +------+            +----------+    +----+
       | receiver |  |           |   |      |  +------+  | CHILD_SA |    | K  |
       +---+------+  | Scheduler |   | IKE- |  | IKE- |--+----------+    | e  |
           |         |           |   | SA   |--| SA   |  | CHILD_SA |    | r  |
    +------+---+     +-----------+   |      |  +------+  +----------+    | n  |
 <->|  socket  |           |         | Man- |                            | e  |
    +------+---+     +-----------+   | ager |  +------+  +----------+    | l  |
           |         |           |   |      |  | IKE- |--| CHILD_SA |    | -  |
       +---+------+  | Processor |---|      |--| SA   |  +----------+    | I  |
       |  sender  |  |           |   |      |  +------+                  | f  |
       +----------+  +-----------+   +------+                            +----+

               |      |      |                        |      |      |
               V      V      V                        V      V      V
      +---------------------------------+       +----------------------------+
      |               Bus               |       |         credentials        |
      +---------------------------------+       +----------------------------+

?SA的状态机

 * State of an IKE_SA.
 *
 * An IKE_SA passes various states in its lifetime. A newly created
 * SA is in the state CREATED.

                 +----------------+
                 |   SA_CREATED   |
                 +----------------+
                         |
    on initiate()--->    |   <----- on IKE_SA_INIT received
                         V
                 +----------------+
                 | SA_CONNECTING  |
                 +----------------+
                         |
                         |   <----- on IKE_AUTH successfully completed
                         V
                 +----------------+
                 | SA_ESTABLISHED |-------------------------+ <-- on rekeying
                 +----------------+                         |
                         |                                  V
    on delete()--->      |   <----- on IKE_SA        +-------------+
                         |          delete request   | SA_REKEYING |
                         |          received         +-------------+
                         V                                  |
                 +----------------+                         |
                 |  SA_DELETING   |<------------------------+ <-- after rekeying
                 +----------------+
                         |
                         |   <----- after delete() acknowledged
                         |
                        \V/
                         X
                        / \

The scheduler is responsible to execute timed events. Jobs may be queued to the scheduler to get executed at a defined time (e.g. rekeying). The scheduler does not execute the jobs itself, it queues them to the processor.

The IKE_SA manager managers all IKE_SA. It further handles the synchronization:
Each IKE_SA must be checked out strictly and checked in again after use. The manager guarantees that only one thread may check out a single IKE_SA. This allows us to write the (complex) IKE_SAs routines non-threadsafe.
The IKE_SA contain the state and the logic of each IKE_SA and handle the?messages.

The CHILD_SA contains state about a IPsec security association and manages them. An IKE_SA may have multiple CHILD_SAs. Communication to the kernel takes place here through the kernel interface.

The kernel interface installs IPsec security associations, policies, routes and virtual addresses. It further provides methods to enumerate interfaces and may notify the daemon about state changes at lower layers.

The bus receives signals from the different threads and relays them to interested listeners. Debugging signals, but also important state changes or error messages are sent over the bus.
Its listeners are not only for logging, but also to track the state of an?IKE_SA.

The controller, credential_manager, bus and backend_manager (config) are places where a plugin ca register itself to provide information or observe and control the daemon.

libcharon目录结构与描述

接下来描述strongswan/src/libcharon/目录下各文件夹的功能和相互关系