src/charon/plugins/ha_sync/ha_sync_segments.c

   1 /*
   2  * Copyright (C) 2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "ha_sync_segments.h"
  17
  18 #include <utils/mutex.h>
  19 #include <utils/linked_list.h>
  20
  21 typedef u_int32_t u32;
  22 typedef u_int8_t u8;
  23
  24 #include <linux/jhash.h>
  25
  26 #define MAX_SEGMENTS 16
  27
  28 typedef struct private_ha_sync_segments_t private_ha_sync_segments_t;
  29
  30 /**
  31  * Private data of an ha_sync_segments_t object.
  32  */
  33 struct private_ha_sync_segments_t {
  34
  35         /**
  36          * Public ha_sync_segments_t interface.
  37          */
  38         ha_sync_segments_t public;
  39
  40         /**
  41          * communication socket
  42          */
  43         ha_sync_socket_t *socket;
  44
  45         /**
  46          * read/write lock for segment manipulation
  47          */
  48         rwlock_t *lock;
  49
  50         /**
  51          * Init value for jhash
  52          */
  53         u_int initval;
  54
  55         /**
  56          * Total number of ClusterIP segments
  57          */
  58         u_int segment_count;
  59
  60         /**
  61          * mask of active segments
  62          */
  63         u_int16_t active;
  64 };
  65
  66 /**
  67  * Check if a host address is in the CLUSTERIP segment
  68  */
  69 static bool in_segment(private_ha_sync_segments_t *this,
  70                                            host_t *host, u_int segment)
  71 {
  72         if (host->get_family(host) == AF_INET)
  73         {
  74                 unsigned long hash;
  75                 u_int32_t addr;
  76
  77                 addr = *(u_int32_t*)host->get_address(host).ptr;
  78                 hash = jhash_1word(ntohl(addr), this->initval);
  79
  80                 if ((((u_int64_t)hash * this->segment_count) >> 32) + 1 == segment)
  81                 {
  82                         return TRUE;
  83                 }
  84         }
  85         return FALSE;
  86 }
  87
  88 /**
  89  * Log currently active segments
  90  */
  91 static void log_segments(private_ha_sync_segments_t *this, bool activated,
  92                                                  u_int segment)
  93 {
  94         char buf[64] = "none", *pos = buf;
  95         int i;
  96         bool first = TRUE;
  97
  98         for (i = 0; i < this->segment_count; i++)
  99         {
 100                 if (this->active & 0x01 << i)
 101                 {
 102                         if (first)
 103                         {
 104                                 first = FALSE;
 105                         }
 106                         else
 107                         {
 108                                 pos += snprintf(pos, buf + sizeof(buf) - pos, ",");
 109                         }
 110                         pos += snprintf(pos, buf + sizeof(buf) - pos, "%d", i+1);
 111                 }
 112         }
 113         DBG1(DBG_CFG, "HA sync segment %d %sactivated, now active: %s",
 114                  segment, activated ? "" : "de", buf);
 115 }
 116
 117 /**
 118  * Get the bit of the segment in the bitmask
 119  */
 120 static inline u_int16_t bit_of(u_int segment)
 121 {
 122         return 0x01 << (segment - 1);
 123 }
 124
 125 /**
 126  * Enable/Disable an an IKE_SA.
 127  */
 128 static void enable_disable(private_ha_sync_segments_t *this, u_int segment,
 129                                                    ike_sa_state_t old, ike_sa_state_t new, bool enable)
 130 {
 131         ike_sa_t *ike_sa;
 132         enumerator_t *enumerator;
 133         u_int i, limit;
 134
 135         this->lock->write_lock(this->lock);
 136
 137         if (segment == 0 || segment <= this->segment_count)
 138         {
 139                 if (segment)
 140                 {       /* loop once for single segment ... */
 141                         limit = segment + 1;
 142                 }
 143                 else
 144                 {       /* or segment_count times for all segments */
 145                         limit = this->segment_count;
 146                 }
 147                 for (i = segment; i < limit; i++)
 148                 {
 149                         if (enable)
 150                         {
 151                                 this->active |= bit_of(i);
 152                         }
 153                         else
 154                         {
 155                                 this->active &= ~bit_of(i);
 156                         }
 157                 }
 158                 enumerator = charon->ike_sa_manager->create_enumerator(charon->ike_sa_manager);
 159                 while (enumerator->enumerate(enumerator, &ike_sa))
 160                 {
 161                         if (ike_sa->get_state(ike_sa) == old)
 162                         {
 163                                 for (i = segment; i < limit; i++)
 164                                 {
 165                                         if (in_segment(this, ike_sa->get_other_host(ike_sa), i))
 166                                         {
 167                                                 ike_sa->set_state(ike_sa, new);
 168                                         }
 169                                 }
 170                         }
 171                 }
 172                 enumerator->destroy(enumerator);
 173
 174                 log_segments(this, enable, segment);
 175         }
 176
 177         this->lock->unlock(this->lock);
 178 }
 179
 180 /**
 181  * Implementation of ha_sync_segments_t.activate
 182  */
 183 static void activate(private_ha_sync_segments_t *this, u_int segment,
 184                                          bool notify)
 185 {
 186         ha_sync_message_t *message;
 187
 188         enable_disable(this, segment, IKE_PASSIVE, IKE_ESTABLISHED, TRUE);
 189
 190         if (notify)
 191         {
 192                 message = ha_sync_message_create(HA_SYNC_SEGMENT_TAKE);
 193                 message->add_attribute(message, HA_SYNC_SEGMENT, segment);
 194                 this->socket->push(this->socket, message);
 195         }
 196 }
 197
 198 /**
 199  * Implementation of ha_sync_segments_t.deactivate
 200  */
 201 static void deactivate(private_ha_sync_segments_t *this, u_int segment,
 202                                            bool notify)
 203 {
 204         ha_sync_message_t *message;
 205
 206         enable_disable(this, segment, IKE_ESTABLISHED, IKE_PASSIVE, FALSE);
 207
 208         if (notify)
 209         {
 210                 message = ha_sync_message_create(HA_SYNC_SEGMENT_DROP);
 211                 message->add_attribute(message, HA_SYNC_SEGMENT, segment);
 212                 this->socket->push(this->socket, message);
 213         }
 214 }
 215
 216 /**
 217  * Rekey all children of an IKE_SA
 218  */
 219 static status_t rekey_children(ike_sa_t *ike_sa)
 220 {
 221         iterator_t *iterator;
 222         child_sa_t *child_sa;
 223         status_t status = SUCCESS;
 224
 225         iterator = ike_sa->create_child_sa_iterator(ike_sa);
 226         while (iterator->iterate(iterator, (void**)&child_sa))
 227         {
 228                 DBG1(DBG_CFG, "resyncing CHILD_SA");
 229                 status = ike_sa->rekey_child_sa(ike_sa, child_sa->get_protocol(child_sa),
 230                                                                                 child_sa->get_spi(child_sa, TRUE));
 231                 if (status == DESTROY_ME)
 232                 {
 233                         break;
 234                 }
 235         }
 236         iterator->destroy(iterator);
 237         return status;
 238 }
 239
 240 /**
 241  * Implementation of ha_sync_segments_t.resync
 242  */
 243 static void resync(private_ha_sync_segments_t *this, u_int segment)
 244 {
 245         ike_sa_t *ike_sa;
 246         enumerator_t *enumerator;
 247         linked_list_t *list;
 248         ike_sa_id_t *id;
 249         u_int16_t mask = bit_of(segment);
 250
 251         list = linked_list_create();
 252         this->lock->read_lock(this->lock);
 253
 254         if (segment > 0 && segment <= this->segment_count && (this->active & mask))
 255         {
 256                 this->active &= ~mask;
 257
 258                 DBG1(DBG_CFG, "resyncing HA sync segment %d", segment);
 259
 260                 /* we do the actual rekeying in a seperate loop to avoid rekeying
 261                  * an SA twice. */
 262                 enumerator = charon->ike_sa_manager->create_enumerator(
 263                                                                                                         charon->ike_sa_manager);
 264                 while (enumerator->enumerate(enumerator, &ike_sa))
 265                 {
 266                         if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
 267                                 in_segment(this, ike_sa->get_other_host(ike_sa), segment))
 268                         {
 269                                 id = ike_sa->get_id(ike_sa);
 270                                 list->insert_last(list, id->clone(id));
 271                         }
 272                 }
 273                 enumerator->destroy(enumerator);
 274         }
 275         this->lock->unlock(this->lock);
 276
 277         while (list->remove_last(list, (void**)&id) == SUCCESS)
 278         {
 279                 ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, id);
 280                 id->destroy(id);
 281                 if (ike_sa)
 282                 {
 283                         DBG1(DBG_CFG, "resyncing IKE_SA");
 284                         if (ike_sa->rekey(ike_sa) != DESTROY_ME)
 285                         {
 286                                 if (rekey_children(ike_sa) != DESTROY_ME)
 287                                 {
 288                                         charon->ike_sa_manager->checkin(
 289                                                                                 charon->ike_sa_manager, ike_sa);
 290                                         continue;
 291                                 }
 292                         }
 293                         charon->ike_sa_manager->checkin_and_destroy(
 294                                                                                 charon->ike_sa_manager, ike_sa);
 295                 }
 296         }
 297         list->destroy(list);
 298 }
 299
 300 /**
 301  * Implementation of ha_sync_segments_t.destroy.
 302  */
 303 static void destroy(private_ha_sync_segments_t *this)
 304 {
 305         this->lock->destroy(this->lock);
 306         free(this);
 307 }
 308
 309 /**
 310  * See header
 311  */
 312 ha_sync_segments_t *ha_sync_segments_create(ha_sync_socket_t *socket)
 313 {
 314         private_ha_sync_segments_t *this = malloc_thing(private_ha_sync_segments_t);
 315         enumerator_t *enumerator;
 316         u_int segment;
 317         char *str;
 318
 319         this->public.activate = (void(*)(ha_sync_segments_t*, u_int segment,bool))activate;
 320         this->public.deactivate = (void(*)(ha_sync_segments_t*, u_int segment,bool))deactivate;
 321         this->public.resync = (void(*)(ha_sync_segments_t*, u_int segment))resync;
 322         this->public.destroy = (void(*)(ha_sync_segments_t*))destroy;
 323
 324         this->socket = socket;
 325         this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
 326         this->initval = 0;
 327         this->active = 0;
 328         this->segment_count = lib->settings->get_int(lib->settings,
 329                                                                 "charon.plugins.ha_sync.segment_count", 1);
 330         this->segment_count = min(this->segment_count, MAX_SEGMENTS);
 331         str = lib->settings->get_str(lib->settings,
 332                                                                 "charon.plugins.ha_sync.active_segments", "1");
 333         enumerator = enumerator_create_token(str, ",", " ");
 334         while (enumerator->enumerate(enumerator, &str))
 335         {
 336                 segment = atoi(str);
 337                 if (segment > 0 && segment < MAX_SEGMENTS)
 338                 {
 339                         this->active |= bit_of(segment);
 340                 }
 341         }
 342         enumerator->destroy(enumerator);
 343
 344         return &this->public;
 345 }
 346