vpn-manager: Add l2tp/ipsec vpn manager

l2tpipsec_vpn.cc

Index: l2tpipsec_vpn.cc
diff --git a/l2tpipsec_vpn.cc b/l2tpipsec_vpn.cc
new file mode 100644
index 0000000000000000000000000000000000000000..83782767dfd63a5aab71f8b8e3fb60fef9069353
--- /dev/null
+++ b/l2tpipsec_vpn.cc
@@ -0,0 +1,126 @@
+// Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <poll.h>
+#include <signal.h>
+#include <stddef.h>
+#include <sys/wait.h>
+
+#include <string>
+
+#include "base/command_line.h"
+#include "base/logging.h"
+#include "chromeos/process.h"
+#include "chromeos/syslog_logging.h"
+#include "gflags/gflags.h"
+#include "vpn-manager/ipsec_manager.h"
+#include "vpn-manager/l2tp_manager.h"
+
+#pragma GCC diagnostic ignored "-Wstrict-aliasing"
+DEFINE_string(client_cert_file, "", "File with IPsec client certificate");
+DEFINE_string(client_key_file, "", "File with IPsec client private key");
+DEFINE_string(psk_file, "", "File with IPsec PSK");
+DEFINE_string(remote, "", "VPN server address");
+DEFINE_string(server_ca_file, "", "File with IPsec server CA");
+#pragma GCC diagnostic error "-Wstrict-aliasing"
+
+// True if a signal has requested termination.
+bool s_terminate_request = false;

[petkov, 2011/03/04 18:42:56]

static?

[kmixter1, 2011/03/05 02:48:59]

Done.

+
+void HandleSignal(int sig_num) {
+  LOG(INFO) << "Caught signal " << sig_num;
+  switch(sig_num) {
+    case SIGTERM:
+    case SIGINT:
+      s_terminate_request = true;
+      break;
+    case SIGALRM:
+      break;
+  }
+}
+
+static void InstallSignalHandlers() {
+  struct sigaction sa;
+  memset(&sa, 0, sizeof(sa));
+  sa.sa_handler = HandleSignal;
+  sigaction(SIGTERM, &sa, NULL);
+  sigaction(SIGINT, &sa, NULL);
+  sigaction(SIGALRM, &sa, NULL);
+}
+
+static void LockDownUmask() {
+  // Only user and group may access configuration files we create.
+  umask(S_IWGRP | S_IROTH | S_IWOTH);
+}
+
+int main(int argc, char* argv[]) {
+  CommandLine::Init(argc, argv);
+  google::ParseCommandLineFlags(&argc, &argv, true);
+  int log_flags = chromeos::kLogToSyslog;
+  if (isatty(STDOUT_FILENO)) log_flags |= chromeos::kLogToStderr;
+  chromeos::InitLog(log_flags);
+  chromeos::OpenLog("l2tpipsec_vpn", true);
+  IpsecManager ipsec;
+  L2tpManager l2tp;
+
+  LockDownUmask();
+
+  ServiceManager::Initialize();
+
+  if (!ipsec.Initialize(1,
+                        FLAGS_remote,
+                        FLAGS_psk_file,
+                        FLAGS_server_ca_file,
+                        FLAGS_client_key_file,
+                        FLAGS_client_cert_file)) {
+    return 1;
+  }
+  if (!l2tp.Initialize(FLAGS_remote)) {
+    return 1;
+  }
+  ServiceManager::SetLayerOrder(&ipsec, &l2tp);
+
+  InstallSignalHandlers();
+  CHECK(ipsec.Start()) << "Unable to start IPsec layer";
+
+  // Event loop.  Events are:

[petkov, 2011/03/04 18:42:56]

move this event loop into a separate function

[kmixter1, 2011/03/05 02:48:59]

Done.

+  // 1) timeout from poll
+  // 2) caught signal
+  // 3) stdout/err of child process ready
+  // 4) child process dies
+  do {
+    int status;
+    int ipsec_poll_timeout = ipsec.Poll();
+    int l2tp_poll_timeout = l2tp.Poll();
+    int poll_timeout = (ipsec_poll_timeout > l2tp_poll_timeout) ?
+        ipsec_poll_timeout : l2tp_poll_timeout;
+
+    const int poll_input_count = 2;
+    struct pollfd poll_inputs[poll_input_count] = {
+      { ipsec.output_fd(), POLLIN },  // ipsec output
+      { l2tp.output_fd(), POLLIN }  // l2tp output
+    };
+    int poll_result = poll(poll_inputs, poll_input_count, poll_timeout);
+    CHECK(poll_result >= 0 || errno == EINTR) << "Unexpected poll result";
+
+    pid_t pid = waitpid(-1, &status, WNOHANG);

[petkov, 2011/03/04 18:42:56]

add a comment what this does...

[kmixter1, 2011/03/05 02:48:59]

Done.

+    if (pid > 0) {
+      ipsec.HandleChild(pid, status);
+      l2tp.HandleChild(pid, status);
+    }
+
+    if (poll_inputs[0].revents & POLLIN) {
+      ServiceManager::WriteFdToSyslog(ipsec.output_fd(), "IPsec: ");
+    }
+    if (poll_inputs[1].revents & POLLIN) {
+      ServiceManager::WriteFdToSyslog(l2tp.output_fd(), "L2TP: ");
+    }
+

[petkov, 2011/03/04 18:42:56]

remove blank line

[kmixter1, 2011/03/05 02:48:59]

Done.

+  } while(!ipsec.was_stopped() && !s_terminate_request);
+  LOG(INFO) << "Shutting down...";
+  l2tp.Stop();
+  // TODO: use error codes to distinguish login failed vs connect
+  // failed.
+  return 0;
+}