src/charon/sa/ike_sa_manager.c

   1 /**
   2  * @file ike_sa_manager.c
   3  *
   4  * @brief Implementation of ike_sa_mananger_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005-2006 Martin Willi
  10  * Copyright (C) 2005 Jan Hutter
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include <pthread.h>
  25 #include <string.h>
  26
  27 #include "ike_sa_manager.h"
  28
  29 #include <daemon.h>
  30 #include <sa/ike_sa_id.h>
  31 #include <bus/bus.h>
  32 #include <utils/linked_list.h>
  33
  34 typedef struct entry_t entry_t;
  35
  36 /**
  37  * An entry in the linked list, contains IKE_SA, locking and lookup data.
  38  */
  39 struct entry_t {
  40
  41         /**
  42          * Number of threads waiting for this ike_sa_t object.
  43          */
  44         int waiting_threads;
  45
  46         /**
  47          * Condvar where threads can wait until ike_sa_t object is free for use again.
  48          */
  49         pthread_cond_t condvar;
  50
  51         /**
  52          * Is this ike_sa currently checked out?
  53          */
  54         bool checked_out;
  55
  56         /**
  57          * Does this SA drives out new threads?
  58          */
  59         bool driveout_new_threads;
  60
  61         /**
  62          * Does this SA drives out waiting threads?
  63          */
  64         bool driveout_waiting_threads;
  65
  66         /**
  67          * Identifiaction of an IKE_SA (SPIs).
  68          */
  69         ike_sa_id_t *ike_sa_id;
  70
  71         /**
  72          * The contained ike_sa_t object.
  73          */
  74         ike_sa_t *ike_sa;
  75
  76         /**
  77          * hash of the IKE_SA_INIT message, used to detect retransmissions
  78          */
  79         chunk_t init_hash;
  80
  81         /**
  82          * message ID currently processing, if any
  83          */
  84         u_int32_t message_id;
  85 };
  86
  87 /**
  88  * Implementation of entry_t.destroy.
  89  */
  90 static status_t entry_destroy(entry_t *this)
  91 {
  92         /* also destroy IKE SA */
  93         this->ike_sa->destroy(this->ike_sa);
  94         this->ike_sa_id->destroy(this->ike_sa_id);
  95         chunk_free(&this->init_hash);
  96         free(this);
  97         return SUCCESS;
  98 }
  99
 100 /**
 101  * Creates a new entry for the ike_sa_t list.
 102  */
 103 static entry_t *entry_create(ike_sa_id_t *ike_sa_id)
 104 {
 105         entry_t *this = malloc_thing(entry_t);
 106
 107         this->waiting_threads = 0;
 108         pthread_cond_init(&this->condvar, NULL);
 109
 110         /* we set checkout flag when we really give it out */
 111         this->checked_out = FALSE;
 112         this->driveout_new_threads = FALSE;
 113         this->driveout_waiting_threads = FALSE;
 114         this->message_id = -1;
 115         this->init_hash = chunk_empty;
 116
 117         /* ike_sa_id is always cloned */
 118         this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
 119
 120         /* create new ike_sa */
 121         this->ike_sa = ike_sa_create(ike_sa_id);
 122
 123         return this;
 124 }
 125
 126
 127 typedef struct private_ike_sa_manager_t private_ike_sa_manager_t;
 128
 129 /**
 130  * Additional private members of ike_sa_manager_t.
 131  */
 132 struct private_ike_sa_manager_t {
 133         /**
 134          * Public interface of ike_sa_manager_t.
 135          */
 136          ike_sa_manager_t public;
 137
 138          /**
 139           * Lock for exclusivly accessing the manager.
 140           */
 141          pthread_mutex_t mutex;
 142
 143          /**
 144           * Linked list with entries for the ike_sa_t objects.
 145           */
 146          linked_list_t *ike_sa_list;
 147
 148          /**
 149           * A randomizer, to get random SPIs for our side
 150           */
 151          randomizer_t *randomizer;
 152
 153          /**
 154           * SHA1 hasher for IKE_SA_INIT retransmit detection
 155           */
 156          hasher_t *hasher;
 157 };
 158
 159 /**
 160  * Implementation of private_ike_sa_manager_t.get_entry_by_id.
 161  */
 162 static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, entry_t **entry)
 163 {
 164         linked_list_t *list = this->ike_sa_list;
 165         iterator_t *iterator;
 166         entry_t *current;
 167         status_t status;
 168
 169         /* create iterator over list of ike_sa's */
 170         iterator = list->create_iterator(list, TRUE);
 171
 172         /* default status */
 173         status = NOT_FOUND;
 174
 175         while (iterator->iterate(iterator, (void**)&current))
 176         {
 177                 if (current->ike_sa_id->equals(current->ike_sa_id, ike_sa_id))
 178                 {
 179                         DBG2(DBG_MGR,  "found entry by both SPIs");
 180                         *entry = current;
 181                         status = SUCCESS;
 182                         break;
 183                 }
 184                 if (ike_sa_id->get_responder_spi(ike_sa_id) == 0 ||
 185                         current->ike_sa_id->get_responder_spi(current->ike_sa_id) == 0)
 186                 {
 187                         /* seems to be a half ready ike_sa */
 188                         if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) ==
 189                                                   ike_sa_id->get_initiator_spi(ike_sa_id)) &&
 190                                 (current->ike_sa_id->is_initiator(ike_sa_id) ==
 191                                                   ike_sa_id->is_initiator(current->ike_sa_id)))
 192                         {
 193                                 DBG2(DBG_MGR, "found entry by initiator SPI");
 194                                 *entry = current;
 195                                 status = SUCCESS;
 196                                 break;
 197                         }
 198                 }
 199         }
 200
 201         iterator->destroy(iterator);
 202         return status;
 203 }
 204
 205 /**
 206  * Implementation of private_ike_sa_manager_t.get_entry_by_sa.
 207  */
 208 static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa, entry_t **entry)
 209 {
 210         linked_list_t *list = this->ike_sa_list;
 211         iterator_t *iterator;
 212         entry_t *current;
 213         status_t status;
 214
 215         iterator = list->create_iterator(list, TRUE);
 216
 217         /* default status */
 218         status = NOT_FOUND;
 219
 220         while (iterator->iterate(iterator, (void**)&current))
 221         {
 222                 /* only pointers are compared */
 223                 if (current->ike_sa == ike_sa)
 224                 {
 225                         DBG2(DBG_MGR, "found entry by pointer");
 226                         *entry = current;
 227                         status = SUCCESS;
 228                         break;
 229                 }
 230         }
 231         iterator->destroy(iterator);
 232
 233         return status;
 234 }
 235
 236 /**
 237  * Implementation of private_ike_sa_manager_s.delete_entry.
 238  */
 239 static status_t delete_entry(private_ike_sa_manager_t *this, entry_t *entry)
 240 {
 241         linked_list_t *list = this->ike_sa_list;
 242         iterator_t *iterator;
 243         entry_t *current;
 244         status_t status;
 245
 246         iterator = list->create_iterator(list, TRUE);
 247
 248         status = NOT_FOUND;
 249
 250         while (iterator->iterate(iterator, (void**)&current))
 251         {
 252                 if (current == entry)
 253                 {
 254                         /* mark it, so now new threads can get this entry */
 255                         entry->driveout_new_threads = TRUE;
 256                         /* wait until all workers have done their work */
 257                         while (entry->waiting_threads)
 258                         {
 259                                 /* wake up all */
 260                                 pthread_cond_broadcast(&(entry->condvar));
 261                                 /* they will wake us again when their work is done */
 262                                 pthread_cond_wait(&(entry->condvar), &(this->mutex));
 263                         }
 264
 265                         DBG2(DBG_MGR,  "found entry by pointer, deleting it");
 266                         iterator->remove(iterator);
 267                         entry_destroy(entry);
 268                         status = SUCCESS;
 269                         break;
 270                 }
 271         }
 272         iterator->destroy(iterator);
 273         return status;
 274 }
 275
 276 /**
 277  * Wait until no other thread is using an IKE_SA, return FALSE if entry not
 278  * acquireable
 279  */
 280 static bool wait_for_entry(private_ike_sa_manager_t *this, entry_t *entry)
 281 {
 282         if (entry->driveout_new_threads)
 283         {
 284                 /* we are not allowed to get this */
 285                 return FALSE;
 286         }
 287         while (entry->checked_out && !entry->driveout_waiting_threads)
 288         {
 289                 /* so wait until we can get it for us.
 290                  * we register us as waiting. */
 291                 entry->waiting_threads++;
 292                 pthread_cond_wait(&(entry->condvar), &(this->mutex));
 293                 entry->waiting_threads--;
 294         }
 295         /* hm, a deletion request forbids us to get this SA, get next one */
 296         if (entry->driveout_waiting_threads)
 297         {
 298                 /* we must signal here, others may be waiting on it, too */
 299                 pthread_cond_signal(&(entry->condvar));
 300                 return FALSE;
 301         }
 302         return TRUE;
 303 }
 304
 305 /**
 306  * Implementation of private_ike_sa_manager_t.get_next_spi.
 307  */
 308 static u_int64_t get_next_spi(private_ike_sa_manager_t *this)
 309 {
 310         u_int64_t spi;
 311
 312         this->randomizer->get_pseudo_random_bytes(this->randomizer, sizeof(spi),
 313                                                                                           (u_int8_t*)&spi);
 314         return spi;
 315 }
 316
 317 /**
 318  * Implementation of of ike_sa_manager.checkout.
 319  */
 320 static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
 321 {
 322         ike_sa_t *ike_sa = NULL;
 323         entry_t *entry;
 324
 325         DBG2(DBG_MGR, "checkout IKE_SA, %d IKE_SAs in manager",
 326                  this->ike_sa_list->get_count(this->ike_sa_list));
 327
 328         pthread_mutex_lock(&(this->mutex));
 329         if (get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
 330         {
 331                 if (wait_for_entry(this, entry))
 332                 {
 333                         DBG2(DBG_MGR, "IKE_SA successfully checked out");
 334                         entry->checked_out = TRUE;
 335                         ike_sa = entry->ike_sa;
 336                 }
 337         }
 338         pthread_mutex_unlock(&this->mutex);
 339         charon->bus->set_sa(charon->bus, ike_sa);
 340         return ike_sa;
 341 }
 342
 343 /**
 344  * Implementation of of ike_sa_manager.checkout_new.
 345  */
 346 static ike_sa_t *checkout_new(private_ike_sa_manager_t* this, bool initiator)
 347 {
 348         entry_t *entry;
 349         ike_sa_id_t *id;
 350
 351         if (initiator)
 352         {
 353                 id = ike_sa_id_create(get_next_spi(this), 0, TRUE);
 354         }
 355         else
 356         {
 357                 id = ike_sa_id_create(0, get_next_spi(this), FALSE);
 358         }
 359         entry = entry_create(id);
 360         id->destroy(id);
 361         pthread_mutex_lock(&this->mutex);
 362         this->ike_sa_list->insert_last(this->ike_sa_list, entry);
 363         entry->checked_out = TRUE;
 364         pthread_mutex_unlock(&this->mutex);
 365         DBG2(DBG_MGR, "created IKE_SA, %d IKE_SAs in manager",
 366                  this->ike_sa_list->get_count(this->ike_sa_list));
 367         return entry->ike_sa;
 368 }
 369
 370 /**
 371  * Implementation of of ike_sa_manager.checkout_by_message.
 372  */
 373 static ike_sa_t* checkout_by_message(private_ike_sa_manager_t* this,
 374                                                                          message_t *message)
 375 {
 376         entry_t *entry;
 377         ike_sa_t *ike_sa = NULL;
 378         ike_sa_id_t *id = message->get_ike_sa_id(message);
 379         id = id->clone(id);
 380         id->switch_initiator(id);
 381
 382         DBG2(DBG_MGR, "checkout IKE_SA by message, %d IKE_SAs in manager",
 383                  this->ike_sa_list->get_count(this->ike_sa_list));
 384
 385         if (message->get_request(message) &&
 386                 message->get_exchange_type(message) == IKE_SA_INIT)
 387         {
 388                 /* IKE_SA_INIT request. Check for an IKE_SA with such a message hash. */
 389                 iterator_t *iterator;
 390                 chunk_t data, hash;
 391
 392                 data = message->get_packet_data(message);
 393                 this->hasher->allocate_hash(this->hasher, data, &hash);
 394                 chunk_free(&data);
 395
 396                 pthread_mutex_lock(&this->mutex);
 397                 iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 398                 while (iterator->iterate(iterator, (void**)&entry))
 399                 {
 400                         if (chunk_equals(hash, entry->init_hash))
 401                         {
 402                                 if (entry->message_id == 0)
 403                                 {
 404                                         iterator->destroy(iterator);
 405                                         pthread_mutex_unlock(&this->mutex);
 406                                         chunk_free(&hash);
 407                                         id->destroy(id);
 408                                         DBG1(DBG_MGR, "ignoring IKE_SA_INIT, already processing");
 409                                         return NULL;
 410                                 }
 411                                 else if (wait_for_entry(this, entry))
 412                                 {
 413                                         DBG2(DBG_MGR, "IKE_SA checked out by hash");
 414                                         entry->checked_out = TRUE;
 415                                         entry->message_id = message->get_message_id(message);
 416                                         ike_sa = entry->ike_sa;
 417                                 }
 418                                 break;
 419                         }
 420                 }
 421                 iterator->destroy(iterator);
 422                 pthread_mutex_unlock(&this->mutex);
 423
 424                 if (ike_sa == NULL)
 425                 {
 426                         if (id->get_responder_spi(id) == 0 &&
 427                                 message->get_exchange_type(message) == IKE_SA_INIT)
 428                         {
 429                                 /* no IKE_SA found, create a new one */
 430                                 id->set_responder_spi(id, get_next_spi(this));
 431                                 entry = entry_create(id);
 432
 433                                 pthread_mutex_lock(&this->mutex);
 434                                 this->ike_sa_list->insert_last(this->ike_sa_list, entry);
 435                                 entry->checked_out = TRUE;
 436                                 entry->message_id = message->get_message_id(message);
 437                                 pthread_mutex_unlock(&this->mutex);
 438                                 entry->init_hash = hash;
 439                                 ike_sa = entry->ike_sa;
 440                         }
 441                         else
 442                         {
 443                                 chunk_free(&hash);
 444                                 DBG1(DBG_MGR, "ignoring message, no such IKE_SA");
 445                         }
 446                 }
 447                 else
 448                 {
 449                         chunk_free(&hash);
 450                 }
 451                 id->destroy(id);
 452                 charon->bus->set_sa(charon->bus, ike_sa);
 453                 return ike_sa;
 454         }
 455
 456         pthread_mutex_lock(&(this->mutex));
 457         if (get_entry_by_id(this, id, &entry) == SUCCESS)
 458         {
 459                 /* only check out if we are not processing this request */
 460                 if (message->get_request(message) &&
 461                         message->get_message_id(message) == entry->message_id)
 462                 {
 463                         DBG1(DBG_MGR, "ignoring request with ID %d, already processing",
 464                                  entry->message_id);
 465                 }
 466                 else if (wait_for_entry(this, entry))
 467                 {
 468                         ike_sa_id_t *ike_id = entry->ike_sa->get_id(entry->ike_sa);
 469                         DBG2(DBG_MGR, "IKE_SA successfully checked out");
 470                         entry->checked_out = TRUE;
 471                         entry->message_id = message->get_message_id(message);
 472                         if (ike_id->get_responder_spi(ike_id) == 0)
 473                         {
 474                                 ike_id->set_responder_spi(ike_id, id->get_responder_spi(id));
 475                         }
 476                         ike_sa = entry->ike_sa;
 477                 }
 478         }
 479         pthread_mutex_unlock(&this->mutex);
 480         id->destroy(id);
 481         charon->bus->set_sa(charon->bus, ike_sa);
 482         return ike_sa;
 483 }
 484
 485 /**
 486  * Implementation of of ike_sa_manager.checkout_by_peer.
 487  */
 488 static ike_sa_t* checkout_by_peer(private_ike_sa_manager_t *this,
 489                                                                   host_t *my_host, host_t *other_host,
 490                                                                   identification_t *my_id,
 491                                                                   identification_t *other_id)
 492 {
 493         iterator_t *iterator;
 494         entry_t *entry;
 495         ike_sa_t *ike_sa = NULL;
 496
 497         pthread_mutex_lock(&(this->mutex));
 498
 499         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 500         while (iterator->iterate(iterator, (void**)&entry))
 501         {
 502                 identification_t *found_my_id, *found_other_id;
 503                 host_t *found_my_host, *found_other_host;
 504                 int wc;
 505
 506                 if (!wait_for_entry(this, entry))
 507                 {
 508                         continue;
 509                 }
 510
 511                 if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING)
 512                 {
 513                         /* skip IKE_SA which are not useable */
 514                         continue;
 515                 }
 516
 517                 found_my_id = entry->ike_sa->get_my_id(entry->ike_sa);
 518                 found_other_id = entry->ike_sa->get_other_id(entry->ike_sa);
 519                 found_my_host = entry->ike_sa->get_my_host(entry->ike_sa);
 520                 found_other_host = entry->ike_sa->get_other_host(entry->ike_sa);
 521
 522                 if (found_my_id->get_type(found_my_id) == ID_ANY &&
 523                         found_other_id->get_type(found_other_id) == ID_ANY)
 524                 {
 525                         /* IKE_SA has no IDs yet, so we can't use it */
 526                         continue;
 527                 }
 528                 DBG2(DBG_MGR, "candidate IKE_SA for \n\t%H[%D]...%H[%D]\n\t%H[%D]...%H[%D]",
 529                          my_host, my_id, other_host, other_id,
 530                          found_my_host, found_my_id, found_other_host, found_other_id);
 531                 /* compare ID and hosts. Supplied ID may contain wildcards, and IP
 532                  * may be %any. */
 533                 if ((my_host->is_anyaddr(my_host) ||
 534                          my_host->ip_equals(my_host, found_my_host)) &&
 535                         (other_host->is_anyaddr(other_host) ||
 536                          other_host->ip_equals(other_host, found_other_host)) &&
 537                         found_my_id->matches(found_my_id, my_id, &wc) &&
 538                         found_other_id->matches(found_other_id, other_id, &wc))
 539                 {
 540                         /* looks good, we take this one */
 541                         DBG2(DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
 542                                  my_host, my_id, other_host, other_id);
 543                         entry->checked_out = TRUE;
 544                         ike_sa = entry->ike_sa;
 545                         break;
 546                 }
 547         }
 548         iterator->destroy(iterator);
 549
 550         if (!ike_sa)
 551         {
 552                 u_int64_t initiator_spi;
 553                 entry_t *new_entry;
 554                 ike_sa_id_t *new_ike_sa_id;
 555
 556                 initiator_spi = get_next_spi(this);
 557                 new_ike_sa_id = ike_sa_id_create(0, 0, TRUE);
 558                 new_ike_sa_id->set_initiator_spi(new_ike_sa_id, initiator_spi);
 559
 560                 /* create entry */
 561                 new_entry = entry_create(new_ike_sa_id);
 562                 DBG2(DBG_MGR, "created IKE_SA");
 563                 new_ike_sa_id->destroy(new_ike_sa_id);
 564
 565                 this->ike_sa_list->insert_last(this->ike_sa_list, new_entry);
 566
 567                 /* check ike_sa out */
 568                 DBG2(DBG_MGR, "new IKE_SA created for IDs [%D]...[%D]", my_id, other_id);
 569                 new_entry->checked_out = TRUE;
 570                 ike_sa = new_entry->ike_sa;
 571         }
 572         pthread_mutex_unlock(&(this->mutex));
 573         charon->bus->set_sa(charon->bus, ike_sa);
 574         return ike_sa;
 575 }
 576
 577 /**
 578  * Implementation of of ike_sa_manager.checkout_by_id.
 579  */
 580 static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this, u_int32_t id,
 581                                                                 bool child)
 582 {
 583         iterator_t *iterator, *children;
 584         entry_t *entry;
 585         ike_sa_t *ike_sa = NULL;
 586         child_sa_t *child_sa;
 587
 588         pthread_mutex_lock(&(this->mutex));
 589
 590         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 591         while (iterator->iterate(iterator, (void**)&entry))
 592         {
 593                 if (wait_for_entry(this, entry))
 594                 {
 595                         /* look for a child with such a reqid ... */
 596                         if (child)
 597                         {
 598                                 children = entry->ike_sa->create_child_sa_iterator(entry->ike_sa);
 599                                 while (children->iterate(children, (void**)&child_sa))
 600                                 {
 601                                         if (child_sa->get_reqid(child_sa) == id)
 602                                         {
 603                                                 ike_sa = entry->ike_sa;
 604                                                 break;
 605                                         }
 606                                 }
 607                                 children->destroy(children);
 608                         }
 609                         else /* ... or for a IKE_SA with such a unique id */
 610                         {
 611                                 if (entry->ike_sa->get_unique_id(entry->ike_sa) == id)
 612                                 {
 613                                         ike_sa = entry->ike_sa;
 614                                 }
 615                         }
 616                         /* got one, return */
 617                         if (ike_sa)
 618                         {
 619                                 entry->checked_out = TRUE;
 620                                 break;
 621                         }
 622                 }
 623         }
 624         iterator->destroy(iterator);
 625         pthread_mutex_unlock(&(this->mutex));
 626
 627         charon->bus->set_sa(charon->bus, ike_sa);
 628         return ike_sa;
 629 }
 630
 631 /**
 632  * Implementation of of ike_sa_manager.checkout_by_name.
 633  */
 634 static ike_sa_t* checkout_by_name(private_ike_sa_manager_t *this, char *name,
 635                                                                   bool child)
 636 {
 637         iterator_t *iterator, *children;
 638         entry_t *entry;
 639         ike_sa_t *ike_sa = NULL;
 640         child_sa_t *child_sa;
 641
 642         pthread_mutex_lock(&(this->mutex));
 643
 644         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 645         while (iterator->iterate(iterator, (void**)&entry))
 646         {
 647                 if (wait_for_entry(this, entry))
 648                 {
 649                         /* look for a child with such a policy name ... */
 650                         if (child)
 651                         {
 652                                 children = entry->ike_sa->create_child_sa_iterator(entry->ike_sa);
 653                                 while (children->iterate(children, (void**)&child_sa))
 654                                 {
 655                                         if (streq(child_sa->get_name(child_sa), name))
 656                                         {
 657                                                 ike_sa = entry->ike_sa;
 658                                                 break;
 659                                         }
 660                                 }
 661                                 children->destroy(children);
 662                         }
 663                         else /* ... or for a IKE_SA with such a connection name */
 664                         {
 665                                 if (streq(entry->ike_sa->get_name(entry->ike_sa), name))
 666                                 {
 667                                         ike_sa = entry->ike_sa;
 668                                 }
 669                         }
 670                         /* got one, return */
 671                         if (ike_sa)
 672                         {
 673                                 entry->checked_out = TRUE;
 674                                 break;
 675                         }
 676                 }
 677         }
 678         iterator->destroy(iterator);
 679         pthread_mutex_unlock(&(this->mutex));
 680
 681         charon->bus->set_sa(charon->bus, ike_sa);
 682         return ike_sa;
 683 }
 684
 685 /**
 686  * Iterator hook for iterate, gets ike_sas instead of entries
 687  */
 688 static hook_result_t iterator_hook(private_ike_sa_manager_t* this, entry_t *in,
 689                                                                    ike_sa_t **out)
 690 {
 691         /* check out entry */
 692         if (wait_for_entry(this, in))
 693         {
 694                 *out = in->ike_sa;
 695                 return HOOK_NEXT;
 696         }
 697         return HOOK_SKIP;
 698 }
 699
 700 /**
 701  * Implementation of ike_sa_manager_t.create_iterator.
 702  */
 703 static iterator_t *create_iterator(private_ike_sa_manager_t* this)
 704 {
 705         iterator_t *iterator = this->ike_sa_list->create_iterator_locked(
 706                                                                                         this->ike_sa_list, &this->mutex);
 707
 708         /* register hook to iterator over ike_sas, not entries */
 709         iterator->set_iterator_hook(iterator, (iterator_hook_t*)iterator_hook, this);
 710         return iterator;
 711 }
 712
 713 /**
 714  * Implementation of ike_sa_manager_t.checkin.
 715  */
 716 static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 717 {
 718         /* to check the SA back in, we look for the pointer of the ike_sa
 719          * in all entries.
 720          * We can't search by SPI's since the MAY have changed (e.g. on reception
 721          * of a IKE_SA_INIT response). Updating of the SPI MAY be necessary...
 722          */
 723         status_t retval;
 724         entry_t *entry;
 725         ike_sa_id_t *ike_sa_id;
 726
 727         ike_sa_id = ike_sa->get_id(ike_sa);
 728
 729         DBG2(DBG_MGR, "checkin IKE_SA");
 730
 731         pthread_mutex_lock(&(this->mutex));
 732
 733         /* look for the entry */
 734         if (get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
 735         {
 736                 /* ike_sa_id must be updated */
 737                 entry->ike_sa_id->replace_values(entry->ike_sa_id, ike_sa->get_id(ike_sa));
 738                 /* signal waiting threads */
 739                 entry->checked_out = FALSE;
 740                 entry->message_id = -1;
 741                 DBG2(DBG_MGR, "check-in of IKE_SA successful.");
 742                 pthread_cond_signal(&(entry->condvar));
 743                 retval = SUCCESS;
 744         }
 745         else
 746         {
 747                 DBG2(DBG_MGR, "tried to check in nonexisting IKE_SA");
 748                 /* this SA is no more, this REALLY should not happen */
 749                 retval = NOT_FOUND;
 750         }
 751
 752         DBG2(DBG_MGR, "%d IKE_SAs in manager now",
 753                  this->ike_sa_list->get_count(this->ike_sa_list));
 754         pthread_mutex_unlock(&(this->mutex));
 755
 756         charon->bus->set_sa(charon->bus, NULL);
 757         return retval;
 758 }
 759
 760
 761 /**
 762  * Implementation of ike_sa_manager_t.checkin_and_destroy.
 763  */
 764 static status_t checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 765 {
 766         /* deletion is a bit complex, we must garant that no thread is waiting for
 767          * this SA.
 768          * We take this SA from the list, and start signaling while threads
 769          * are in the condvar.
 770          */
 771         entry_t *entry;
 772         status_t retval;
 773         ike_sa_id_t *ike_sa_id;
 774
 775         ike_sa_id = ike_sa->get_id(ike_sa);
 776         DBG2(DBG_MGR, "checkin and destroy IKE_SA");
 777
 778         pthread_mutex_lock(&(this->mutex));
 779
 780         if (get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
 781         {
 782                 /* drive out waiting threads, as we are in hurry */
 783                 entry->driveout_waiting_threads = TRUE;
 784
 785                 delete_entry(this, entry);
 786
 787                 DBG2(DBG_MGR, "check-in and destroy of IKE_SA successful");
 788                 retval = SUCCESS;
 789         }
 790         else
 791         {
 792                 DBG2(DBG_MGR, "tried to check-in and delete nonexisting IKE_SA");
 793                 retval = NOT_FOUND;
 794         }
 795
 796         pthread_mutex_unlock(&(this->mutex));
 797         charon->bus->set_sa(charon->bus, ike_sa);
 798         return retval;
 799 }
 800
 801 /**
 802  * Implementation of ike_sa_manager_t.get_half_open_count.
 803  */
 804 static int get_half_open_count(private_ike_sa_manager_t *this, host_t *ip)
 805 {
 806         iterator_t *iterator;
 807         entry_t *entry;
 808         int count = 0;
 809
 810         pthread_mutex_lock(&(this->mutex));
 811         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 812         while (iterator->iterate(iterator, (void**)&entry))
 813         {
 814                 /* we check if we have a responder CONNECTING IKE_SA without checkout */
 815                 if (!entry->ike_sa_id->is_initiator(entry->ike_sa_id) &&
 816                         entry->ike_sa->get_state(entry->ike_sa) == IKE_CONNECTING)
 817                 {
 818                         /* if we have a host, we have wait until no other uses the IKE_SA */
 819                         if (ip)
 820                         {
 821                                 if (wait_for_entry(this, entry) && ip->ip_equals(ip,
 822                                                                 entry->ike_sa->get_other_host(entry->ike_sa)))
 823                                 {
 824                                         count++;
 825                                 }
 826                         }
 827                         else
 828                         {
 829                                 count++;
 830                         }
 831                 }
 832         }
 833         iterator->destroy(iterator);
 834
 835         pthread_mutex_unlock(&(this->mutex));
 836         return count;
 837 }
 838
 839 /**
 840  * Implementation of ike_sa_manager_t.destroy.
 841  */
 842 static void destroy(private_ike_sa_manager_t *this)
 843 {
 844         /* destroy all list entries */
 845         linked_list_t *list = this->ike_sa_list;
 846         iterator_t *iterator;
 847         entry_t *entry;
 848
 849         pthread_mutex_lock(&(this->mutex));
 850         DBG2(DBG_MGR, "going to destroy IKE_SA manager and all managed IKE_SA's");
 851         /* Step 1: drive out all waiting threads  */
 852         DBG2(DBG_MGR, "set driveout flags for all stored IKE_SA's");
 853         iterator = list->create_iterator(list, TRUE);
 854         while (iterator->iterate(iterator, (void**)&entry))
 855         {
 856                 /* do not accept new threads, drive out waiting threads */
 857                 entry->driveout_new_threads = TRUE;
 858                 entry->driveout_waiting_threads = TRUE;
 859         }
 860         DBG2(DBG_MGR, "wait for all threads to leave IKE_SA's");
 861         /* Step 2: wait until all are gone */
 862         iterator->reset(iterator);
 863         while (iterator->iterate(iterator, (void**)&entry))
 864         {
 865                 while (entry->waiting_threads)
 866                 {
 867                         /* wake up all */
 868                         pthread_cond_broadcast(&(entry->condvar));
 869                         /* go sleeping until they are gone */
 870                         pthread_cond_wait(&(entry->condvar), &(this->mutex));
 871                 }
 872         }
 873         DBG2(DBG_MGR, "delete all IKE_SA's");
 874         /* Step 3: initiate deletion of all IKE_SAs */
 875         iterator->reset(iterator);
 876         while (iterator->iterate(iterator, (void**)&entry))
 877         {
 878                 entry->ike_sa->delete(entry->ike_sa);
 879         }
 880         iterator->destroy(iterator);
 881
 882         DBG2(DBG_MGR, "destroy all entries");
 883         /* Step 4: destroy all entries */
 884         list->destroy_function(list, (void*)entry_destroy);
 885         pthread_mutex_unlock(&(this->mutex));
 886
 887         this->randomizer->destroy(this->randomizer);
 888         this->hasher->destroy(this->hasher);
 889
 890         free(this);
 891 }
 892
 893 /*
 894  * Described in header.
 895  */
 896 ike_sa_manager_t *ike_sa_manager_create()
 897 {
 898         private_ike_sa_manager_t *this = malloc_thing(private_ike_sa_manager_t);
 899
 900         /* assign public functions */
 901         this->public.destroy = (void(*)(ike_sa_manager_t*))destroy;
 902         this->public.checkout = (ike_sa_t*(*)(ike_sa_manager_t*, ike_sa_id_t*))checkout;
 903         this->public.checkout_new = (ike_sa_t*(*)(ike_sa_manager_t*,bool))checkout_new;
 904         this->public.checkout_by_message = (ike_sa_t*(*)(ike_sa_manager_t*,message_t*))checkout_by_message;
 905         this->public.checkout_by_peer = (ike_sa_t*(*)(ike_sa_manager_t*,host_t*,host_t*,identification_t*,identification_t*))checkout_by_peer;
 906         this->public.checkout_by_id = (ike_sa_t*(*)(ike_sa_manager_t*,u_int32_t,bool))checkout_by_id;
 907         this->public.checkout_by_name = (ike_sa_t*(*)(ike_sa_manager_t*,char*,bool))checkout_by_name;
 908         this->public.create_iterator = (iterator_t*(*)(ike_sa_manager_t*))create_iterator;
 909         this->public.checkin = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin;
 910         this->public.checkin_and_destroy = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin_and_destroy;
 911         this->public.get_half_open_count = (int(*)(ike_sa_manager_t*,host_t*))get_half_open_count;
 912
 913         /* initialize private variables */
 914         this->ike_sa_list = linked_list_create();
 915         pthread_mutex_init(&this->mutex, NULL);
 916         this->randomizer = randomizer_create();
 917         this->hasher = hasher_create(HASH_SHA1);
 918
 919         return &this->public;
 920 }