2 * @file ike_sa_manager.c
4 * @brief Implementation of ike_sa_mananger_t.
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
26 #include "ike_sa_manager.h"
29 #include <sa/ike_sa_id.h>
30 #include <utils/allocator.h>
31 #include <utils/logger.h>
32 #include <utils/logger_manager.h>
33 #include <utils/linked_list.h>
35 typedef struct ike_sa_entry_t ike_sa_entry_t
;
38 * An entry in the linked list, contains IKE_SA, locking and lookup data.
40 struct ike_sa_entry_t
{
42 * Destructor, also destroys associated ike_sa_t object.
44 status_t (*destroy
) (ike_sa_entry_t
*this);
47 * Number of threads waiting for this ike_sa_t object.
52 * Condvar where threads can wait until ike_sa_t object is free for use again.
54 pthread_cond_t condvar
;
57 * Is this ike_sa currently checked out?
62 * Does this SA drives out new threads?
64 bool driveout_new_threads
;
67 * Does this SA drives out waiting threads?
69 bool driveout_waiting_threads
;
72 * Identifiaction of an IKE_SA (SPIs).
74 ike_sa_id_t
*ike_sa_id
;
77 * The contained ike_sa_t object.
83 * Implementation of ike_sa_entry_t.destroy.
85 static status_t
ike_sa_entry_destroy(ike_sa_entry_t
*this)
87 /* also destroy IKE SA */
88 this->ike_sa
->destroy(this->ike_sa
);
89 this->ike_sa_id
->destroy(this->ike_sa_id
);
95 * @brief Creates a new entry for the ike_sa_t list.
97 * This constructor additionaly creates a new and empty SA.
99 * @param ike_sa_id The associated ike_sa_id_t, will be cloned
100 * @return ike_sa_entry_t object
102 static ike_sa_entry_t
*ike_sa_entry_create(ike_sa_id_t
*ike_sa_id
)
104 ike_sa_entry_t
*this = allocator_alloc_thing(ike_sa_entry_t
);
106 /* destroy function */
107 this->destroy
= ike_sa_entry_destroy
;
109 this->waiting_threads
= 0;
110 pthread_cond_init(&(this->condvar
), NULL
);
112 /* we set checkout flag when we really give it out */
113 this->checked_out
= FALSE
;
114 this->driveout_new_threads
= FALSE
;
115 this->driveout_waiting_threads
= FALSE
;
117 /* ike_sa_id is always cloned */
118 this->ike_sa_id
= ike_sa_id
->clone(ike_sa_id
);
120 /* create new ike_sa */
121 this->ike_sa
= ike_sa_create(ike_sa_id
);
127 typedef struct private_ike_sa_manager_t private_ike_sa_manager_t
;
130 * Additional private members of ike_sa_manager_t.
132 struct private_ike_sa_manager_t
{
134 * Public interface of ike_sa_manager_t.
136 ike_sa_manager_t
public;
139 * @brief Get next spi.
141 * We give out SPIs incremental starting at 1.
143 * @param this the ike_sa_manager
144 * @return the next spi
146 u_int64_t (*get_next_spi
) (private_ike_sa_manager_t
*this);
149 * @brief Find the ike_sa_entry_t object in the list by SPIs.
151 * This function simply iterates over the linked list. A hash-table
152 * would be more efficient when storing a lot of IKE_SAs...
154 * @param this calling object
155 * @param ike_sa_id id of the ike_sa, containing SPIs
156 * @param[out] entry pointer to set to the found entry
158 * - SUCCESS when found,
159 * - NOT_FOUND when no such ike_sa_id in list
161 status_t (*get_entry_by_id
) (private_ike_sa_manager_t
*this, ike_sa_id_t
*ike_sa_id
, ike_sa_entry_t
**entry
);
164 * @brief Find the ike_sa_entry_t in the list by pointer to SA.
166 * This function simply iterates over the linked list. A hash-table
167 * would be more efficient when storing a lot of IKE_SAs...
169 * @param this calling object
170 * @param ike_sa pointer to the ike_sa
171 * @param[out] entry pointer to set to the found entry
173 * - SUCCESS when found,
174 * - NOT_FOUND when no such ike_sa_id in list
176 status_t (*get_entry_by_sa
) (private_ike_sa_manager_t
*this, ike_sa_t
*ike_sa
, ike_sa_entry_t
**entry
);
179 * @brief Felete an entry from the linked list.
181 * @param this calling object
182 * @param entry entry to delete
184 * - SUCCESS when found,
185 * - NOT_FOUND when no such ike_sa_id in list
187 status_t (*delete_entry
) (private_ike_sa_manager_t
*this, ike_sa_entry_t
*entry
);
190 * Lock for exclusivly accessing the manager.
192 pthread_mutex_t mutex
;
195 * Logger used for this IKE SA Manager.
200 * Linked list with entries for the ike_sa_t objects.
202 linked_list_t
*ike_sa_list
;
205 * Next SPI, needed for incremental creation of SPIs.
211 * Implementation of private_ike_sa_manager_t.get_entry_by_id.
213 static status_t
get_entry_by_id(private_ike_sa_manager_t
*this, ike_sa_id_t
*ike_sa_id
, ike_sa_entry_t
**entry
)
215 linked_list_t
*list
= this->ike_sa_list
;
216 iterator_t
*iterator
;
219 /* create iterator over list of ike_sa's */
220 iterator
= list
->create_iterator(list
, TRUE
);
225 while (iterator
->has_next(iterator
))
227 ike_sa_entry_t
*current
;
229 iterator
->current(iterator
, (void**)¤t
);
230 if (current
->ike_sa_id
->get_responder_spi(current
->ike_sa_id
) == 0)
232 /* seems to be a half ready ike_sa */
233 if ((current
->ike_sa_id
->get_initiator_spi(current
->ike_sa_id
) == ike_sa_id
->get_initiator_spi(ike_sa_id
))
234 && (ike_sa_id
->is_initiator(ike_sa_id
) == current
->ike_sa_id
->is_initiator(current
->ike_sa_id
)))
236 this->logger
->log(this->logger
,CONTROL
| LEVEL2
,"Found entry by initiator spi %d",ike_sa_id
->get_initiator_spi(ike_sa_id
));
242 else if (ike_sa_id
->get_responder_spi(ike_sa_id
) == 0)
244 if ((current
->ike_sa_id
->get_initiator_spi(current
->ike_sa_id
) == ike_sa_id
->get_initiator_spi(ike_sa_id
))
245 && (ike_sa_id
->is_initiator(ike_sa_id
) == current
->ike_sa_id
->is_initiator(current
->ike_sa_id
)))
247 this->logger
->log(this->logger
,CONTROL
| LEVEL2
,"Found entry by initiator spi %d",ike_sa_id
->get_initiator_spi(ike_sa_id
));
253 if (current
->ike_sa_id
->equals(current
->ike_sa_id
, ike_sa_id
))
255 this->logger
->log(this->logger
,CONTROL
| LEVEL2
,"Found entry by full ID");
262 iterator
->destroy(iterator
);
267 * Implementation of private_ike_sa_manager_t.get_entry_by_sa.
269 static status_t
get_entry_by_sa(private_ike_sa_manager_t
*this, ike_sa_t
*ike_sa
, ike_sa_entry_t
**entry
)
271 linked_list_t
*list
= this->ike_sa_list
;
272 iterator_t
*iterator
;
275 iterator
= list
->create_iterator(list
, TRUE
);
280 while (iterator
->has_next(iterator
))
282 ike_sa_entry_t
*current
;
283 iterator
->current(iterator
, (void**)¤t
);
284 /* only pointers are compared */
285 if (current
->ike_sa
== ike_sa
)
287 this->logger
->log(this->logger
,CONTROL
| LEVEL2
,"Found entry by pointer");
293 iterator
->destroy(iterator
);
299 * Implementation of private_ike_sa_manager_s.delete_entry.
301 static status_t
delete_entry(private_ike_sa_manager_t
*this, ike_sa_entry_t
*entry
)
303 linked_list_t
*list
= this->ike_sa_list
;
304 iterator_t
*iterator
;
307 iterator
= list
->create_iterator(list
, TRUE
);
311 while (iterator
->has_next(iterator
))
313 ike_sa_entry_t
*current
;
314 iterator
->current(iterator
, (void**)¤t
);
315 if (current
== entry
)
317 this->logger
->log(this->logger
,CONTROL
| LEVEL2
,"Found entry by pointer. Going to delete it.");
318 iterator
->remove(iterator
);
319 entry
->destroy(entry
);
324 iterator
->destroy(iterator
);
330 * Implementation of private_ike_sa_manager_t.get_next_spi.
332 static u_int64_t
get_next_spi(private_ike_sa_manager_t
*this)
335 if (this->next_spi
== 0) {
336 /* TODO handle overflow,
337 * delete all SAs or so
340 return this->next_spi
;
344 * Implementation of of ike_sa_manager.create_and_checkout.
346 static void create_and_checkout(private_ike_sa_manager_t
*this,ike_sa_t
**ike_sa
)
348 u_int64_t initiator_spi
;
349 ike_sa_entry_t
*new_ike_sa_entry
;
350 ike_sa_id_t
*new_ike_sa_id
;
352 initiator_spi
= this->get_next_spi(this);
353 new_ike_sa_id
= ike_sa_id_create(0, 0, TRUE
);
354 new_ike_sa_id
->set_initiator_spi(new_ike_sa_id
, initiator_spi
);
357 new_ike_sa_entry
= ike_sa_entry_create(new_ike_sa_id
);
358 new_ike_sa_id
->destroy(new_ike_sa_id
);
360 /* each access is locked */
361 pthread_mutex_lock(&(this->mutex
));
363 this->ike_sa_list
->insert_last(this->ike_sa_list
, new_ike_sa_entry
);
365 /* check ike_sa out */
366 this->logger
->log(this->logger
,CONTROL
| LEVEL1
,"New IKE_SA created and added to list of known IKE_SA's");
367 new_ike_sa_entry
->checked_out
= TRUE
;
368 *ike_sa
= new_ike_sa_entry
->ike_sa
;
370 pthread_mutex_unlock(&(this->mutex
));
374 * Implementation of of ike_sa_manager.checkout.
376 static status_t
checkout(private_ike_sa_manager_t
*this, ike_sa_id_t
*ike_sa_id
, ike_sa_t
**ike_sa
)
378 bool responder_spi_set
;
379 bool initiator_spi_set
;
380 bool original_initiator
;
383 /* each access is locked */
384 pthread_mutex_lock(&(this->mutex
));
386 responder_spi_set
= (FALSE
!= ike_sa_id
->get_responder_spi(ike_sa_id
));
387 initiator_spi_set
= (FALSE
!= ike_sa_id
->get_initiator_spi(ike_sa_id
));
388 original_initiator
= ike_sa_id
->is_initiator(ike_sa_id
);
390 if ((initiator_spi_set
&& responder_spi_set
) ||
391 ((initiator_spi_set
&& !responder_spi_set
) && (original_initiator
)))
393 /* we SHOULD have an IKE_SA for these SPIs in the list,
394 * if not, we can't handle the request...
396 ike_sa_entry_t
*entry
;
397 /* look for the entry */
398 if (this->get_entry_by_id(this, ike_sa_id
, &entry
) == SUCCESS
)
400 /* can we give this ike_sa out to new requesters?*/
401 if (entry
->driveout_new_threads
)
403 this->logger
->log(this->logger
,CONTROL
|LEVEL1
,"Drive out new thread for existing IKE_SA");
409 /* is this IKE_SA already checked out ??
410 * are we welcome to get this SA ? */
411 while (entry
->checked_out
&& !entry
->driveout_waiting_threads
)
413 /* so wait until we can get it for us.
414 * we register us as waiting.
416 entry
->waiting_threads
++;
417 pthread_cond_wait(&(entry
->condvar
), &(this->mutex
));
418 entry
->waiting_threads
--;
421 /* hm, a deletion request forbids us to get this SA, go home */
422 if (entry
->driveout_waiting_threads
)
424 /* we must signal here, others are interested that we leave */
425 pthread_cond_signal(&(entry
->condvar
));
426 this->logger
->log(this->logger
,CONTROL
|LEVEL1
,"Drive out waiting thread for existing IKE_SA");
431 this->logger
->log(this->logger
,CONTROL
|LEVEL2
,"IKE SA successfully checked out");
432 /* ok, this IKE_SA is finally ours */
433 entry
->checked_out
= TRUE
;
434 *ike_sa
= entry
->ike_sa
;
435 /* DON'T use return, we must unlock the mutex! */
442 this->logger
->log(this->logger
,ERROR
| LEVEL1
,"IKE SA not stored in known IKE_SA list");
443 /* looks like there is no such IKE_SA, better luck next time... */
444 /* DON'T use return, we must unlock the mutex! */
448 else if ((initiator_spi_set
&& !responder_spi_set
) && (!original_initiator
))
450 /* an IKE_SA_INIT from an another endpoint,
451 * he is the initiator.
452 * For simplicity, we do NOT check for retransmitted
453 * IKE_SA_INIT-Requests here, so EVERY single IKE_SA_INIT-
454 * Request (even a retransmitted one) will result in a
455 * IKE_SA. This could be improved...
457 u_int64_t responder_spi
;
458 ike_sa_entry_t
*new_ike_sa_entry
;
461 /* set SPIs, we are the responder */
462 responder_spi
= this->get_next_spi(this);
464 /* we also set arguments spi, so its still valid */
465 ike_sa_id
->set_responder_spi(ike_sa_id
, responder_spi
);
468 new_ike_sa_entry
= ike_sa_entry_create(ike_sa_id
);
470 this->ike_sa_list
->insert_last(this->ike_sa_list
, new_ike_sa_entry
);
472 /* check ike_sa out */
473 this->logger
->log(this->logger
,CONTROL
| LEVEL1
,"IKE_SA added to list of known IKE_SA's");
474 new_ike_sa_entry
->checked_out
= TRUE
;
475 *ike_sa
= new_ike_sa_entry
->ike_sa
;
481 /* responder set, initiator not: here is something seriously wrong! */
482 this->logger
->log(this->logger
,ERROR
| LEVEL1
, "Invalid IKE_SA SPI's");
483 /* DON'T use return, we must unlock the mutex! */
484 retval
= INVALID_ARG
;
487 pthread_mutex_unlock(&(this->mutex
));
488 /* OK, unlocked... */
493 * Implementation of ike_sa_manager_t.checkin.
495 static status_t
checkin(private_ike_sa_manager_t
*this, ike_sa_t
*ike_sa
)
497 /* to check the SA back in, we look for the pointer of the ike_sa
499 * We can't search by SPI's since the MAY have changed (e.g. on reception
500 * of a IKE_SA_INIT response). Updating of the SPI MAY be necessary...
503 ike_sa_entry_t
*entry
;
505 pthread_mutex_lock(&(this->mutex
));
507 /* look for the entry */
508 if (this->get_entry_by_sa(this, ike_sa
, &entry
) == SUCCESS
)
510 /* ike_sa_id must be updated */
511 entry
->ike_sa_id
->replace_values(entry
->ike_sa_id
, ike_sa
->get_id(ike_sa
));
512 /* signal waiting threads */
513 entry
->checked_out
= FALSE
;
514 this->logger
->log(this->logger
,CONTROL
| LEVEL1
,"Checkin of IKE_SA successful.");
515 pthread_cond_signal(&(entry
->condvar
));
520 this->logger
->log(this->logger
,ERROR
,"Fatal Error: Tried to checkin nonexisting IKE_SA");
521 /* this SA is no more, this RELEVEL3Y should not happen */
524 pthread_mutex_unlock(&(this->mutex
));
530 * Implementation of ike_sa_manager_t.checkin_and_delete.
532 static status_t
checkin_and_delete(private_ike_sa_manager_t
*this, ike_sa_t
*ike_sa
)
534 /* deletion is a bit complex, we must garant that no thread is waiting for
536 * We take this SA from the list, and start signaling while threads
537 * are in the condvar.
539 ike_sa_entry_t
*entry
;
542 pthread_mutex_lock(&(this->mutex
));
544 if (this->get_entry_by_sa(this, ike_sa
, &entry
) == SUCCESS
)
546 /* mark it, so now new threads can acquire this SA */
547 entry
->driveout_new_threads
= TRUE
;
548 /* additionaly, drive out waiting threads */
549 entry
->driveout_waiting_threads
= TRUE
;
551 /* wait until all workers have done their work */
552 while (entry
->waiting_threads
> 0)
554 /* let the other threads do some work*/
555 pthread_cond_signal(&(entry
->condvar
));
556 /* and the nice thing, they will wake us again when their work is done */
557 pthread_cond_wait(&(entry
->condvar
), &(this->mutex
));
559 /* ok, we are alone now, no threads waiting in the entry's condvar */
560 this->delete_entry(this, entry
);
561 this->logger
->log(this->logger
,CONTROL
| LEVEL1
,"Checkin and delete of IKE_SA successful");
566 this->logger
->log(this->logger
,ERROR
,"Fatal Error: Tried to checkin and delete nonexisting IKE_SA");
570 pthread_mutex_unlock(&(this->mutex
));
575 * Implementation of ike_sa_manager_t.delete.
577 static status_t
delete(private_ike_sa_manager_t
*this, ike_sa_id_t
*ike_sa_id
)
579 /* deletion is a bit complex, we must garant that no thread is waiting for
581 * We take this SA from the list, and start signaling while threads
582 * are in the condvar.
584 ike_sa_entry_t
*entry
;
587 pthread_mutex_lock(&(this->mutex
));
589 if (this->get_entry_by_id(this, ike_sa_id
, &entry
) == SUCCESS
)
591 /* mark it, so now new threads can acquire this SA */
592 entry
->driveout_new_threads
= TRUE
;
594 /* wait until all workers have done their work */
595 while (entry
->waiting_threads
)
598 pthread_cond_signal(&(entry
->condvar
));
599 /* and the nice thing, they will wake us again when their work is done */
600 pthread_cond_wait(&(entry
->condvar
), &(this->mutex
));
602 /* ok, we are alone now, no threads waiting in the entry's condvar */
603 this->delete_entry(this, entry
);
604 this->logger
->log(this->logger
,CONTROL
| LEVEL1
,"Delete of IKE_SA successful");
609 this->logger
->log(this->logger
,ERROR
,"Fatal Error: Tried to delete nonexisting IKE_SA");
613 pthread_mutex_unlock(&(this->mutex
));
618 * Implementation of ike_sa_manager_t.destroy.
620 static void destroy(private_ike_sa_manager_t
*this)
622 /* destroy all list entries */
623 linked_list_t
*list
= this->ike_sa_list
;
624 iterator_t
*iterator
;
625 ike_sa_entry_t
*entry
;
627 pthread_mutex_lock(&(this->mutex
));
629 this->logger
->log(this->logger
,CONTROL
| LEVEL1
,"Going to destroy IKE_SA manager and all managed IKE_SA's");
631 /* Step 1: drive out all waiting threads */
632 iterator
= list
->create_iterator(list
, TRUE
);
634 this->logger
->log(this->logger
,CONTROL
| LEVEL2
,"Set driveout flags for all stored IKE_SA's");
635 while (iterator
->has_next(iterator
))
637 iterator
->current(iterator
, (void**)&entry
);
638 /* do not accept new threads, drive out waiting threads */
639 entry
->driveout_new_threads
= TRUE
;
640 entry
->driveout_waiting_threads
= TRUE
;
643 this->logger
->log(this->logger
,CONTROL
| LEVEL2
,"Wait for all threads to leave IKE_SA's");
644 /* Step 2: wait until all are gone */
645 iterator
->reset(iterator
);
646 while (iterator
->has_next(iterator
))
648 iterator
->current(iterator
, (void**)&entry
);
649 while (entry
->waiting_threads
)
652 pthread_cond_signal(&(entry
->condvar
));
653 /* go sleeping until they are gone */
654 pthread_cond_wait(&(entry
->condvar
), &(this->mutex
));
657 this->logger
->log(this->logger
,CONTROL
| LEVEL2
,"Delete all IKE_SA's");
658 /* Step 3: delete all entries */
659 iterator
->destroy(iterator
);
661 while (list
->get_count(list
) > 0)
663 list
->get_first(list
, (void**)&entry
);
664 this->delete_entry(this, entry
);
667 this->logger
->log(this->logger
,CONTROL
| LEVEL2
,"IKE_SA's deleted");
668 pthread_mutex_unlock(&(this->mutex
));
670 /* destroy logger at end */
671 charon
->logger_manager
->destroy_logger(charon
->logger_manager
,this->logger
);
673 allocator_free(this);
677 * Described in header.
679 ike_sa_manager_t
*ike_sa_manager_create()
681 private_ike_sa_manager_t
*this = allocator_alloc_thing(private_ike_sa_manager_t
);
683 /* assign public functions */
684 this->public.destroy
= (void(*)(ike_sa_manager_t
*))destroy
;
685 this->public.create_and_checkout
= (void(*)(ike_sa_manager_t
*, ike_sa_t
**sa
))create_and_checkout
;
686 this->public.checkout
= (status_t(*)(ike_sa_manager_t
*, ike_sa_id_t
*sa_id
, ike_sa_t
**sa
))checkout
;
687 this->public.checkin
= (status_t(*)(ike_sa_manager_t
*, ike_sa_t
*sa
))checkin
;
688 this->public.delete = (status_t(*)(ike_sa_manager_t
*, ike_sa_id_t
*sa_id
))delete;
689 this->public.checkin_and_delete
= (status_t(*)(ike_sa_manager_t
*, ike_sa_t
*ike_sa
))checkin_and_delete
;
691 /* initialize private functions */
692 this->get_next_spi
= get_next_spi
;
693 this->get_entry_by_sa
= get_entry_by_sa
;
694 this->get_entry_by_id
= get_entry_by_id
;
695 this->delete_entry
= delete_entry
;
697 /* initialize private variables */
698 this->logger
= charon
->logger_manager
->create_logger(charon
->logger_manager
,IKE_SA_MANAGER
,NULL
);
700 this->ike_sa_list
= linked_list_create();
702 pthread_mutex_init(&(this->mutex
), NULL
);
706 return (ike_sa_manager_t
*)this;