943502dcbdd290e365125b38b5a02d08ebdd9de9
[strongswan.git] / Source / charon / sa / ike_sa_manager.c
1 /**
2 * @file ike_sa_manager.c
3 *
4 * @brief Implementation of ike_sa_mananger_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include <pthread.h>
24 #include <string.h>
25
26 #include "ike_sa_manager.h"
27
28 #include <globals.h>
29 #include <sa/ike_sa_id.h>
30 #include <utils/allocator.h>
31 #include <utils/logger.h>
32 #include <utils/logger_manager.h>
33 #include <utils/linked_list.h>
34
35 typedef struct ike_sa_entry_t ike_sa_entry_t;
36
37 /**
38 * An entry in the linked list, contains IKE_SA, locking and lookup data.
39 */
40 struct ike_sa_entry_t {
41 /**
42 * destructor, also destroys ike_sa
43 */
44 status_t (*destroy) (ike_sa_entry_t *this);
45 /**
46 * Number of threads waiting for this ike_sa
47 */
48 int waiting_threads;
49 /**
50 * condvar where threads can wait until it's free again
51 */
52 pthread_cond_t condvar;
53 /**
54 * is this ike_sa currently checked out?
55 */
56 bool checked_out;
57 /**
58 * Does this SA drives out new threads?
59 */
60 bool driveout_new_threads;
61 /**
62 * Does this SA drives out waiting threads?
63 */
64 bool driveout_waiting_threads;
65 /**
66 * identifiaction of ike_sa (SPIs)
67 */
68 ike_sa_id_t *ike_sa_id;
69 /**
70 * the contained ike_sa
71 */
72 ike_sa_t *ike_sa;
73 };
74
75 /**
76 * Implements ike_sa_entry_t.destroy.
77 */
78 static status_t ike_sa_entry_destroy(ike_sa_entry_t *this)
79 {
80 /* also destroy IKE SA */
81 this->ike_sa->destroy(this->ike_sa);
82 this->ike_sa_id->destroy(this->ike_sa_id);
83 allocator_free(this);
84 return SUCCESS;
85 }
86
87 /**
88 * @brief creates a new entry for the ike_sa list
89 *
90 * This constructor additionaly creates a new and empty SA.
91 *
92 * @param ike_sa_id the associated ike_sa_id_t, will be cloned
93 * @return created entry, with ike_sa and ike_sa_id
94 */
95 static ike_sa_entry_t *ike_sa_entry_create(ike_sa_id_t *ike_sa_id)
96 {
97 ike_sa_entry_t *this = allocator_alloc_thing(ike_sa_entry_t);
98
99 /* destroy function */
100 this->destroy = ike_sa_entry_destroy;
101
102 this->waiting_threads = 0;
103 pthread_cond_init(&(this->condvar), NULL);
104
105 /* we set checkout flag when we really give it out */
106 this->checked_out = FALSE;
107 this->driveout_new_threads = FALSE;
108 this->driveout_waiting_threads = FALSE;
109
110 /* ike_sa_id is always cloned */
111 this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
112
113 /* create new ike_sa */
114 this->ike_sa = ike_sa_create(ike_sa_id);
115
116 return this;
117 }
118
119 typedef struct private_ike_sa_manager_t private_ike_sa_manager_t;
120
121 /**
122 * Additional private members to ike_sa_manager_t
123 */
124 struct private_ike_sa_manager_t {
125 /**
126 * Public members
127 */
128 ike_sa_manager_t public;
129
130 /**
131 * @brief get next spi
132 *
133 * we give out SPIs incremental.
134 *
135 * @param this the ike_sa_manager
136 * @return the next spi
137 */
138 u_int64_t (*get_next_spi) (private_ike_sa_manager_t *this);
139
140 /**
141 * @brief find the ike_sa_entry in the list by SPIs.
142 *
143 * This function simply iterates over the linked list. A hash-table
144 * would be more efficient when storing a lot of IKE_SAs...
145 *
146 * @param this the ike_sa_manager containing the list
147 * @param ike_sa_id id of the ike_sa, containing SPIs
148 * @param entry[out] pointer to set to the found entry
149 * @return
150 * - SUCCESS when found,
151 * - NOT_FOUND when no such ike_sa_id in list
152 */
153 status_t (*get_entry_by_id) (private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_entry_t **entry);
154
155 /**
156 * @brief find the ike_sa_entry in the list by pointer to SA.
157 *
158 * This function simply iterates over the linked list. A hash-table
159 * would be more efficient when storing a lot of IKE_SAs...
160 *
161 * @param this the ike_sa_manager containing the list
162 * @param ike_sa pointer to the ike_sa
163 * @param entry[out] pointer to set to the found entry
164 * @return
165 * - SUCCESS when found,
166 * - NOT_FOUND when no such ike_sa_id in list
167 */
168 status_t (*get_entry_by_sa) (private_ike_sa_manager_t *this, ike_sa_t *ike_sa, ike_sa_entry_t **entry);
169
170 /**
171 * @brief delete an entry from the linked list
172 *
173 * @param this the ike_sa_manager containing the list
174 * @param entry entry to delete
175 * @return
176 * - SUCCESS when found,
177 * - NOT_FOUND when no such ike_sa_id in list
178 */
179 status_t (*delete_entry) (private_ike_sa_manager_t *this, ike_sa_entry_t *entry);
180
181 /**
182 * lock for exclusivly accessing the manager
183 */
184 pthread_mutex_t mutex;
185
186 /**
187 * Logger used for this IKE SA Manager
188 */
189 logger_t *logger;
190
191 /**
192 * Linked list with entries for the ike_sa
193 */
194 linked_list_t *ike_sa_list;
195
196 /**
197 * Next SPI, needed for incremental creation of SPIs
198 */
199 u_int64_t next_spi;
200 };
201
202 /**
203 * Implements private_ike_sa_manager_t.get_entry_by_id.
204 */
205 static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_entry_t **entry)
206 {
207 linked_list_t *list = this->ike_sa_list;
208 iterator_t *iterator;
209 status_t status;
210
211 /* create iterator over list of ike_sa's */
212 list->create_iterator(list, &iterator, TRUE);
213
214 /* default status */
215 status = NOT_FOUND;
216
217 while (iterator->has_next(iterator))
218 {
219 ike_sa_entry_t *current;
220
221 iterator->current(iterator, (void**)&current);
222 if (current->ike_sa_id->get_responder_spi(current->ike_sa_id) == 0) {
223 /* seems to be a half ready ike_sa */
224 if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) == ike_sa_id->get_initiator_spi(ike_sa_id))
225 && (ike_sa_id->is_initiator(ike_sa_id) == current->ike_sa_id->is_initiator(current->ike_sa_id)))
226 {
227 this->logger->log(this->logger,CONTROL | MOST,"Found entry by initiator spi %d",ike_sa_id->get_initiator_spi(ike_sa_id));
228 *entry = current;
229 status = SUCCESS;
230 break;
231 }
232 }
233 if (current->ike_sa_id->equals(current->ike_sa_id, ike_sa_id))
234 {
235 this->logger->log(this->logger,CONTROL | MOST,"Found entry by full ID");
236 *entry = current;
237 status = SUCCESS;
238 break;
239 }
240 }
241
242 iterator->destroy(iterator);
243 return status;
244 }
245
246 /**
247 * Implements private_ike_sa_manager_t.get_entry_by_sa.
248 */
249 static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa, ike_sa_entry_t **entry)
250 {
251 linked_list_t *list = this->ike_sa_list;
252 iterator_t *iterator;
253 status_t status;
254
255 list->create_iterator(list, &iterator, TRUE);
256
257 /* default status */
258 status = NOT_FOUND;
259
260 while (iterator->has_next(iterator))
261 {
262 ike_sa_entry_t *current;
263 iterator->current(iterator, (void**)&current);
264 /* only pointers are compared */
265 if (current->ike_sa == ike_sa)
266 {
267 this->logger->log(this->logger,CONTROL | MOST,"Found entry by pointer");
268 *entry = current;
269 status = SUCCESS;
270 break;
271 }
272 }
273 iterator->destroy(iterator);
274
275 return status;
276 }
277
278 /**
279 * Implements private_ike_sa_manager_s.delete_entry.
280 */
281 static status_t delete_entry(private_ike_sa_manager_t *this, ike_sa_entry_t *entry)
282 {
283 linked_list_t *list = this->ike_sa_list;
284 iterator_t *iterator;
285 status_t status;
286
287 list->create_iterator(list, &iterator, TRUE);
288
289 status = NOT_FOUND;
290
291 while (iterator->has_next(iterator))
292 {
293 ike_sa_entry_t *current;
294 iterator->current(iterator, (void**)&current);
295 if (current == entry)
296 {
297 this->logger->log(this->logger,CONTROL | MOST,"Found entry by pointer. Going to delete it.");
298 iterator->remove(iterator);
299 entry->destroy(entry);
300 status = SUCCESS;
301 break;
302 }
303 }
304 iterator->destroy(iterator);
305 return status;
306 }
307
308
309 /**
310 * Implements private_ike_sa_manager_t.get_next_spi.
311 */
312 static u_int64_t get_next_spi(private_ike_sa_manager_t *this)
313 {
314 this->next_spi++;
315 if (this->next_spi == 0) {
316 /* TODO handle overflow,
317 * delete all SAs or so
318 */
319 }
320 return this->next_spi;
321 }
322
323 /**
324 * Implementation of ike_sa_manager.create_and_checkout.
325 */
326 static void create_and_checkout(private_ike_sa_manager_t *this,ike_sa_t **ike_sa)
327 {
328 u_int64_t initiator_spi;
329 ike_sa_entry_t *new_ike_sa_entry;
330 ike_sa_id_t *new_ike_sa_id;
331
332 initiator_spi = this->get_next_spi(this);
333 new_ike_sa_id = ike_sa_id_create(0, 0, TRUE);
334 new_ike_sa_id->set_initiator_spi(new_ike_sa_id, initiator_spi);
335
336 /* create entry */
337 new_ike_sa_entry = ike_sa_entry_create(new_ike_sa_id);
338 new_ike_sa_id->destroy(new_ike_sa_id);
339
340 /* each access is locked */
341 pthread_mutex_lock(&(this->mutex));
342
343 this->ike_sa_list->insert_last(this->ike_sa_list, new_ike_sa_entry);
344
345 /* check ike_sa out */
346 this->logger->log(this->logger,CONTROL | MORE ,"New IKE_SA created and added to list of known IKE_SA's");
347 new_ike_sa_entry->checked_out = TRUE;
348 *ike_sa = new_ike_sa_entry->ike_sa;
349
350 pthread_mutex_unlock(&(this->mutex));
351 }
352
353 /**
354 * Implementation of ike_sa_manager.checkout.
355 */
356 static status_t checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_t **ike_sa)
357 {
358 bool responder_spi_set;
359 bool initiator_spi_set;
360 status_t retval;
361
362 /* each access is locked */
363 pthread_mutex_lock(&(this->mutex));
364
365 responder_spi_set = (FALSE != ike_sa_id->get_responder_spi(ike_sa_id));
366 initiator_spi_set = (FALSE != ike_sa_id->get_initiator_spi(ike_sa_id));
367
368 if (initiator_spi_set && responder_spi_set)
369 {
370 /* we SHOULD have an IKE_SA for these SPIs in the list,
371 * if not, we can't handle the request...
372 */
373 ike_sa_entry_t *entry;
374 /* look for the entry */
375 if (this->get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
376 {
377 /* can we give this ike_sa out to new requesters?*/
378 if (entry->driveout_new_threads)
379 {
380 this->logger->log(this->logger,CONTROL|MORE,"Drive out new thread for existing IKE_SA");
381 /* no we can't */
382 retval = NOT_FOUND;
383 }
384 else
385 {
386 /* is this IKE_SA already checked out ??
387 * are we welcome to get this SA ? */
388 while (entry->checked_out && !entry->driveout_waiting_threads)
389 {
390 /* so wait until we can get it for us.
391 * we register us as waiting.
392 */
393 entry->waiting_threads++;
394 pthread_cond_wait(&(entry->condvar), &(this->mutex));
395 entry->waiting_threads--;
396 }
397
398 /* hm, a deletion request forbids us to get this SA, go home */
399 if (entry->driveout_waiting_threads)
400 {
401 /* we must signal here, others are interested that we leave */
402 pthread_cond_signal(&(entry->condvar));
403 this->logger->log(this->logger,CONTROL|MORE,"Drive out waiting thread for existing IKE_SA");
404 retval = NOT_FOUND;
405 }
406 else
407 {
408 this->logger->log(this->logger,CONTROL|MOST,"IKE SA successfully checked out");
409 /* ok, this IKE_SA is finally ours */
410 entry->checked_out = TRUE;
411 *ike_sa = entry->ike_sa;
412 /* DON'T use return, we must unlock the mutex! */
413 retval = SUCCESS;
414 }
415 }
416 }
417 else
418 {
419 this->logger->log(this->logger,ERROR | MORE,"IKE SA not stored in known IKE_SA list");
420 /* looks like there is no such IKE_SA, better luck next time... */
421 /* DON'T use return, we must unlock the mutex! */
422 retval = NOT_FOUND;
423 }
424 }
425 else if (initiator_spi_set && !responder_spi_set)
426 {
427 /* an IKE_SA_INIT from an another endpoint,
428 * he is the initiator.
429 * For simplicity, we do NOT check for retransmitted
430 * IKE_SA_INIT-Requests here, so EVERY single IKE_SA_INIT-
431 * Request (even a retransmitted one) will result in a
432 * IKE_SA. This could be improved...
433 */
434 u_int64_t responder_spi;
435 ike_sa_entry_t *new_ike_sa_entry;
436
437
438 /* set SPIs, we are the responder */
439 responder_spi = this->get_next_spi(this);
440
441 /* we also set arguments spi, so its still valid */
442 ike_sa_id->set_responder_spi(ike_sa_id, responder_spi);
443
444 /* create entry */
445 new_ike_sa_entry = ike_sa_entry_create(ike_sa_id);
446
447 this->ike_sa_list->insert_last(this->ike_sa_list, new_ike_sa_entry);
448
449 /* check ike_sa out */
450 this->logger->log(this->logger,CONTROL | MORE ,"IKE_SA added to list of known IKE_SA's");
451 new_ike_sa_entry->checked_out = TRUE;
452 *ike_sa = new_ike_sa_entry->ike_sa;
453
454 retval = SUCCESS;
455 }
456 else
457 {
458 /* responder set, initiator not: here is something seriously wrong! */
459 this->logger->log(this->logger,ERROR | MORE, "Invalid IKE_SA SPI's");
460 /* DON'T use return, we must unlock the mutex! */
461 retval = INVALID_ARG;
462 }
463
464 pthread_mutex_unlock(&(this->mutex));
465 /* OK, unlocked... */
466 return retval;
467 }
468
469 /**
470 * Implements ike_sa_manager_t.checkin.
471 */
472 static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
473 {
474 /* to check the SA back in, we look for the pointer of the ike_sa
475 * in all entries.
476 * We can't search by SPI's since the MAY have changed (e.g. on reception
477 * of a IKE_SA_INIT response). Updating of the SPI MAY be necessary...
478 */
479 status_t retval;
480 ike_sa_entry_t *entry;
481
482 pthread_mutex_lock(&(this->mutex));
483
484 /* look for the entry */
485 if (this->get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
486 {
487 /* ike_sa_id must be updated */
488 entry->ike_sa_id->replace_values(entry->ike_sa_id, ike_sa->get_id(ike_sa));
489 /* signal waiting threads */
490 entry->checked_out = FALSE;
491 this->logger->log(this->logger,CONTROL | MORE,"Checkin of IKE_SA successful.");
492 pthread_cond_signal(&(entry->condvar));
493 retval = SUCCESS;
494 }
495 else
496 {
497 this->logger->log(this->logger,ERROR,"Fatal Error: Tried to checkin nonexisting IKE_SA");
498 /* this SA is no more, this REALLY should not happen */
499 retval = NOT_FOUND;
500 }
501 pthread_mutex_unlock(&(this->mutex));
502 return retval;
503 }
504
505
506 /**
507 * Implements ike_sa_manager_t.checkin_and_delete.
508 */
509 static status_t checkin_and_delete(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
510 {
511 /* deletion is a bit complex, we must garant that no thread is waiting for
512 * this SA.
513 * We take this SA from the list, and start signaling while threads
514 * are in the condvar.
515 */
516 ike_sa_entry_t *entry;
517 status_t retval;
518
519 pthread_mutex_lock(&(this->mutex));
520
521 if (this->get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
522 {
523 /* mark it, so now new threads can acquire this SA */
524 entry->driveout_new_threads = TRUE;
525 /* additionaly, drive out waiting threads */
526 entry->driveout_waiting_threads = TRUE;
527
528 /* wait until all workers have done their work */
529 while (entry->waiting_threads > 0)
530 {
531 /* let the other threads do some work*/
532 pthread_cond_signal(&(entry->condvar));
533 /* and the nice thing, they will wake us again when their work is done */
534 pthread_cond_wait(&(entry->condvar), &(this->mutex));
535 }
536 /* ok, we are alone now, no threads waiting in the entry's condvar */
537 this->delete_entry(this, entry);
538 this->logger->log(this->logger,CONTROL | MORE,"Checkin and delete of IKE_SA successful");
539 retval = SUCCESS;
540 }
541 else
542 {
543 this->logger->log(this->logger,ERROR,"Fatal Error: Tried to checkin and delete nonexisting IKE_SA");
544 retval = NOT_FOUND;
545 }
546
547 pthread_mutex_unlock(&(this->mutex));
548 return retval;
549 }
550
551 /**
552 * Implements ike_sa_manager_t.delete.
553 */
554 static status_t delete(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
555 {
556 /* deletion is a bit complex, we must garant that no thread is waiting for
557 * this SA.
558 * We take this SA from the list, and start signaling while threads
559 * are in the condvar.
560 */
561 ike_sa_entry_t *entry;
562 status_t retval;
563
564 pthread_mutex_lock(&(this->mutex));
565
566 if (this->get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
567 {
568 /* mark it, so now new threads can acquire this SA */
569 entry->driveout_new_threads = TRUE;
570
571 /* wait until all workers have done their work */
572 while (entry->waiting_threads)
573 {
574 /* wake up all */
575 pthread_cond_signal(&(entry->condvar));
576 /* and the nice thing, they will wake us again when their work is done */
577 pthread_cond_wait(&(entry->condvar), &(this->mutex));
578 }
579 /* ok, we are alone now, no threads waiting in the entry's condvar */
580 this->delete_entry(this, entry);
581 this->logger->log(this->logger,CONTROL | MORE,"Delete of IKE_SA successful");
582 retval = SUCCESS;
583 }
584 else
585 {
586 this->logger->log(this->logger,ERROR,"Fatal Error: Tried to delete nonexisting IKE_SA");
587 retval = NOT_FOUND;
588 }
589
590 pthread_mutex_unlock(&(this->mutex));
591 return retval;
592 }
593
594 /**
595 * Implements ike_sa_manager_t.destroy.
596 */
597 static void destroy(private_ike_sa_manager_t *this)
598 {
599 /* destroy all list entries */
600 linked_list_t *list = this->ike_sa_list;
601 iterator_t *iterator;
602 ike_sa_entry_t *entry;
603
604 pthread_mutex_lock(&(this->mutex));
605
606 this->logger->log(this->logger,CONTROL | MORE,"Going to destroy IKE_SA manager and all managed IKE_SA's");
607
608 /* Step 1: drive out all waiting threads */
609 list->create_iterator(list, &iterator, TRUE);
610
611 this->logger->log(this->logger,CONTROL | MOST,"Set driveout flags for all stored IKE_SA's");
612 while (iterator->has_next(iterator))
613 {
614 iterator->current(iterator, (void**)&entry);
615 /* do not accept new threads, drive out waiting threads */
616 entry->driveout_new_threads = TRUE;
617 entry->driveout_waiting_threads = TRUE;
618 }
619
620 this->logger->log(this->logger,CONTROL | MOST,"Wait for all threads to leave IKE_SA's");
621 /* Step 2: wait until all are gone */
622 iterator->reset(iterator);
623 while (iterator->has_next(iterator))
624 {
625 iterator->current(iterator, (void**)&entry);
626 while (entry->waiting_threads)
627 {
628 /* wake up all */
629 pthread_cond_signal(&(entry->condvar));
630 /* go sleeping until they are gone */
631 pthread_cond_wait(&(entry->condvar), &(this->mutex));
632 }
633 }
634 this->logger->log(this->logger,CONTROL | MOST,"Delete all IKE_SA's");
635 /* Step 3: delete all entries */
636 iterator->destroy(iterator);
637
638 while (list->get_count(list) > 0)
639 {
640 list->get_first(list, (void**)&entry);
641 this->delete_entry(this, entry);
642 }
643 list->destroy(list);
644 this->logger->log(this->logger,CONTROL | MOST,"IKE_SA's deleted");
645 pthread_mutex_unlock(&(this->mutex));
646
647 /* destroy logger at end */
648 global_logger_manager->destroy_logger(global_logger_manager,this->logger);
649
650 allocator_free(this);
651 }
652
653 /*
654 * Described in header
655 */
656 ike_sa_manager_t *ike_sa_manager_create()
657 {
658 private_ike_sa_manager_t *this = allocator_alloc_thing(private_ike_sa_manager_t);
659
660 /* assign public functions */
661 this->public.destroy = (void(*)(ike_sa_manager_t*))destroy;
662 this->public.create_and_checkout = (void(*)(ike_sa_manager_t*, ike_sa_t **sa))create_and_checkout;
663 this->public.checkout = (status_t(*)(ike_sa_manager_t*, ike_sa_id_t *sa_id, ike_sa_t **sa))checkout;
664 this->public.checkin = (status_t(*)(ike_sa_manager_t*, ike_sa_t *sa))checkin;
665 this->public.delete = (status_t(*)(ike_sa_manager_t*, ike_sa_id_t *sa_id))delete;
666 this->public.checkin_and_delete = (status_t(*)(ike_sa_manager_t*, ike_sa_t *ike_sa))checkin_and_delete;
667
668 /* initialize private functions */
669 this->get_next_spi = get_next_spi;
670 this->get_entry_by_sa = get_entry_by_sa;
671 this->get_entry_by_id = get_entry_by_id;
672 this->delete_entry = delete_entry;
673
674 /* initialize private variables */
675 this->logger = global_logger_manager->create_logger(global_logger_manager,IKE_SA_MANAGER,NULL);
676
677 this->ike_sa_list = linked_list_create();
678
679 pthread_mutex_init(&(this->mutex), NULL);
680
681 this->next_spi = 0;
682
683 return (ike_sa_manager_t*)this;
684 }