(no commit message)
[strongswan.git] / src / charon / sa / ike_sa_manager.c
1 /**
2 * @file ike_sa_manager.c
3 *
4 * @brief Implementation of ike_sa_mananger_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include <pthread.h>
24 #include <string.h>
25
26 #include "ike_sa_manager.h"
27
28 #include <daemon.h>
29 #include <sa/ike_sa_id.h>
30 #include <utils/logger.h>
31 #include <utils/logger_manager.h>
32 #include <utils/linked_list.h>
33
34 typedef struct ike_sa_entry_t ike_sa_entry_t;
35
36 /**
37 * An entry in the linked list, contains IKE_SA, locking and lookup data.
38 */
39 struct ike_sa_entry_t {
40 /**
41 * Destructor, also destroys associated ike_sa_t object.
42 */
43 status_t (*destroy) (ike_sa_entry_t *this);
44
45 /**
46 * Number of threads waiting for this ike_sa_t object.
47 */
48 int waiting_threads;
49
50 /**
51 * Condvar where threads can wait until ike_sa_t object is free for use again.
52 */
53 pthread_cond_t condvar;
54
55 /**
56 * Is this ike_sa currently checked out?
57 */
58 bool checked_out;
59
60 /**
61 * Does this SA drives out new threads?
62 */
63 bool driveout_new_threads;
64
65 /**
66 * Does this SA drives out waiting threads?
67 */
68 bool driveout_waiting_threads;
69
70 /**
71 * Identifiaction of an IKE_SA (SPIs).
72 */
73 ike_sa_id_t *ike_sa_id;
74
75 /**
76 * The contained ike_sa_t object.
77 */
78 ike_sa_t *ike_sa;
79 };
80
81 /**
82 * Implementation of ike_sa_entry_t.destroy.
83 */
84 static status_t ike_sa_entry_destroy(ike_sa_entry_t *this)
85 {
86 /* also destroy IKE SA */
87 this->ike_sa->destroy(this->ike_sa);
88 this->ike_sa_id->destroy(this->ike_sa_id);
89 free(this);
90 return SUCCESS;
91 }
92
93 /**
94 * @brief Creates a new entry for the ike_sa_t list.
95 *
96 * This constructor additionaly creates a new and empty SA.
97 *
98 * @param ike_sa_id The associated ike_sa_id_t, will be cloned
99 * @return ike_sa_entry_t object
100 */
101 static ike_sa_entry_t *ike_sa_entry_create(ike_sa_id_t *ike_sa_id)
102 {
103 ike_sa_entry_t *this = malloc_thing(ike_sa_entry_t);
104
105 /* destroy function */
106 this->destroy = ike_sa_entry_destroy;
107
108 this->waiting_threads = 0;
109 pthread_cond_init(&(this->condvar), NULL);
110
111 /* we set checkout flag when we really give it out */
112 this->checked_out = FALSE;
113 this->driveout_new_threads = FALSE;
114 this->driveout_waiting_threads = FALSE;
115
116 /* ike_sa_id is always cloned */
117 this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
118
119 /* create new ike_sa */
120 this->ike_sa = ike_sa_create(ike_sa_id);
121
122 return this;
123 }
124
125
126 typedef struct private_ike_sa_manager_t private_ike_sa_manager_t;
127
128 /**
129 * Additional private members of ike_sa_manager_t.
130 */
131 struct private_ike_sa_manager_t {
132 /**
133 * Public interface of ike_sa_manager_t.
134 */
135 ike_sa_manager_t public;
136
137 /**
138 * @brief Get next spi.
139 *
140 * We give out SPIs incremental starting at 1.
141 *
142 * @param this the ike_sa_manager
143 * @return the next spi
144 */
145 u_int64_t (*get_next_spi) (private_ike_sa_manager_t *this);
146
147 /**
148 * @brief Find the ike_sa_entry_t object in the list by SPIs.
149 *
150 * This function simply iterates over the linked list. A hash-table
151 * would be more efficient when storing a lot of IKE_SAs...
152 *
153 * @param this calling object
154 * @param ike_sa_id id of the ike_sa, containing SPIs
155 * @param[out] entry pointer to set to the found entry
156 * @return
157 * - SUCCESS when found,
158 * - NOT_FOUND when no such ike_sa_id in list
159 */
160 status_t (*get_entry_by_id) (private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_entry_t **entry);
161
162 /**
163 * @brief Find the ike_sa_entry_t in the list by pointer to SA.
164 *
165 * This function simply iterates over the linked list. A hash-table
166 * would be more efficient when storing a lot of IKE_SAs...
167 *
168 * @param this calling object
169 * @param ike_sa pointer to the ike_sa
170 * @param[out] entry pointer to set to the found entry
171 * @return
172 * - SUCCESS when found,
173 * - NOT_FOUND when no such ike_sa_id in list
174 */
175 status_t (*get_entry_by_sa) (private_ike_sa_manager_t *this, ike_sa_t *ike_sa, ike_sa_entry_t **entry);
176
177 /**
178 * @brief Felete an entry from the linked list.
179 *
180 * @param this calling object
181 * @param entry entry to delete
182 * @return
183 * - SUCCESS when found,
184 * - NOT_FOUND when no such ike_sa_id in list
185 */
186 status_t (*delete_entry) (private_ike_sa_manager_t *this, ike_sa_entry_t *entry);
187
188 /**
189 * Lock for exclusivly accessing the manager.
190 */
191 pthread_mutex_t mutex;
192
193 /**
194 * Logger used for this IKE SA Manager.
195 */
196 logger_t *logger;
197
198 /**
199 * Linked list with entries for the ike_sa_t objects.
200 */
201 linked_list_t *ike_sa_list;
202
203 /**
204 * A randomizer, to get random SPIs for our side
205 */
206 randomizer_t *randomizer;
207 };
208
209 /**
210 * Implementation of private_ike_sa_manager_t.get_entry_by_id.
211 */
212 static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_entry_t **entry)
213 {
214 linked_list_t *list = this->ike_sa_list;
215 iterator_t *iterator;
216 status_t status;
217
218 /* create iterator over list of ike_sa's */
219 iterator = list->create_iterator(list, TRUE);
220
221 /* default status */
222 status = NOT_FOUND;
223
224 while (iterator->has_next(iterator))
225 {
226 ike_sa_entry_t *current;
227
228 iterator->current(iterator, (void**)&current);
229 if (current->ike_sa_id->get_responder_spi(current->ike_sa_id) == 0)
230 {
231 /* seems to be a half ready ike_sa */
232 if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) == ike_sa_id->get_initiator_spi(ike_sa_id))
233 && (ike_sa_id->is_initiator(ike_sa_id) == current->ike_sa_id->is_initiator(current->ike_sa_id)))
234 {
235 this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by initiator spi %d",ike_sa_id->get_initiator_spi(ike_sa_id));
236 *entry = current;
237 status = SUCCESS;
238 break;
239 }
240 }
241 else if (ike_sa_id->get_responder_spi(ike_sa_id) == 0)
242 {
243 if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) == ike_sa_id->get_initiator_spi(ike_sa_id))
244 && (ike_sa_id->is_initiator(ike_sa_id) == current->ike_sa_id->is_initiator(current->ike_sa_id)))
245 {
246 this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by initiator spi %d",ike_sa_id->get_initiator_spi(ike_sa_id));
247 *entry = current;
248 status = SUCCESS;
249 break;
250 }
251 }
252 if (current->ike_sa_id->equals(current->ike_sa_id, ike_sa_id))
253 {
254 this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by full ID");
255 *entry = current;
256 status = SUCCESS;
257 break;
258 }
259 }
260
261 iterator->destroy(iterator);
262 return status;
263 }
264
265 /**
266 * Implementation of private_ike_sa_manager_t.get_entry_by_sa.
267 */
268 static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa, ike_sa_entry_t **entry)
269 {
270 linked_list_t *list = this->ike_sa_list;
271 iterator_t *iterator;
272 status_t status;
273
274 iterator = list->create_iterator(list, TRUE);
275
276 /* default status */
277 status = NOT_FOUND;
278
279 while (iterator->has_next(iterator))
280 {
281 ike_sa_entry_t *current;
282 iterator->current(iterator, (void**)&current);
283 /* only pointers are compared */
284 if (current->ike_sa == ike_sa)
285 {
286 this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by pointer");
287 *entry = current;
288 status = SUCCESS;
289 break;
290 }
291 }
292 iterator->destroy(iterator);
293
294 return status;
295 }
296
297 /**
298 * Implementation of private_ike_sa_manager_s.delete_entry.
299 */
300 static status_t delete_entry(private_ike_sa_manager_t *this, ike_sa_entry_t *entry)
301 {
302 linked_list_t *list = this->ike_sa_list;
303 iterator_t *iterator;
304 status_t status;
305
306 iterator = list->create_iterator(list, TRUE);
307
308 status = NOT_FOUND;
309
310 while (iterator->has_next(iterator))
311 {
312 ike_sa_entry_t *current;
313 iterator->current(iterator, (void**)&current);
314 if (current == entry)
315 {
316 this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by pointer. Going to delete it.");
317 iterator->remove(iterator);
318 entry->destroy(entry);
319 status = SUCCESS;
320 break;
321 }
322 }
323 iterator->destroy(iterator);
324 return status;
325 }
326
327
328 /**
329 * Implementation of private_ike_sa_manager_t.get_next_spi.
330 */
331 static u_int64_t get_next_spi(private_ike_sa_manager_t *this)
332 {
333 u_int64_t spi;
334
335 this->randomizer->get_pseudo_random_bytes(this->randomizer, 8, (u_int8_t*)&spi);
336
337 return spi;
338 }
339
340 /**
341 * Implementation of of ike_sa_manager.create_and_checkout.
342 */
343 static void create_and_checkout(private_ike_sa_manager_t *this,ike_sa_t **ike_sa)
344 {
345 u_int64_t initiator_spi;
346 ike_sa_entry_t *new_ike_sa_entry;
347 ike_sa_id_t *new_ike_sa_id;
348
349 initiator_spi = this->get_next_spi(this);
350 new_ike_sa_id = ike_sa_id_create(0, 0, TRUE);
351 new_ike_sa_id->set_initiator_spi(new_ike_sa_id, initiator_spi);
352
353 /* create entry */
354 new_ike_sa_entry = ike_sa_entry_create(new_ike_sa_id);
355 new_ike_sa_id->destroy(new_ike_sa_id);
356
357 /* each access is locked */
358 pthread_mutex_lock(&(this->mutex));
359
360 this->ike_sa_list->insert_last(this->ike_sa_list, new_ike_sa_entry);
361
362 /* check ike_sa out */
363 this->logger->log(this->logger,CONTROL | LEVEL1 ,"New IKE_SA created and added to list of known IKE_SA's");
364 new_ike_sa_entry->checked_out = TRUE;
365 *ike_sa = new_ike_sa_entry->ike_sa;
366
367 pthread_mutex_unlock(&(this->mutex));
368 }
369
370 /**
371 * Implementation of of ike_sa_manager.checkout.
372 */
373 static status_t checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_t **ike_sa)
374 {
375 bool responder_spi_set;
376 bool initiator_spi_set;
377 bool original_initiator;
378 status_t retval;
379
380 /* each access is locked */
381 pthread_mutex_lock(&(this->mutex));
382
383 responder_spi_set = (FALSE != ike_sa_id->get_responder_spi(ike_sa_id));
384 initiator_spi_set = (FALSE != ike_sa_id->get_initiator_spi(ike_sa_id));
385 original_initiator = ike_sa_id->is_initiator(ike_sa_id);
386
387 if ((initiator_spi_set && responder_spi_set) ||
388 ((initiator_spi_set && !responder_spi_set) && (original_initiator)))
389 {
390 /* we SHOULD have an IKE_SA for these SPIs in the list,
391 * if not, we can't handle the request...
392 */
393 ike_sa_entry_t *entry;
394 /* look for the entry */
395 if (this->get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
396 {
397 /* can we give this ike_sa out to new requesters?*/
398 if (entry->driveout_new_threads)
399 {
400 this->logger->log(this->logger,CONTROL|LEVEL1,"Drive out new thread for existing IKE_SA");
401 /* no we can't */
402 retval = NOT_FOUND;
403 }
404 else
405 {
406 /* is this IKE_SA already checked out ??
407 * are we welcome to get this SA ? */
408 while (entry->checked_out && !entry->driveout_waiting_threads)
409 {
410 /* so wait until we can get it for us.
411 * we register us as waiting.
412 */
413 entry->waiting_threads++;
414 pthread_cond_wait(&(entry->condvar), &(this->mutex));
415 entry->waiting_threads--;
416 }
417
418 /* hm, a deletion request forbids us to get this SA, go home */
419 if (entry->driveout_waiting_threads)
420 {
421 /* we must signal here, others are interested that we leave */
422 pthread_cond_signal(&(entry->condvar));
423 this->logger->log(this->logger,CONTROL|LEVEL1,"Drive out waiting thread for existing IKE_SA");
424 retval = NOT_FOUND;
425 }
426 else
427 {
428 this->logger->log(this->logger,CONTROL|LEVEL2,"IKE SA successfully checked out");
429 /* ok, this IKE_SA is finally ours */
430 entry->checked_out = TRUE;
431 *ike_sa = entry->ike_sa;
432 /* DON'T use return, we must unlock the mutex! */
433 retval = SUCCESS;
434 }
435 }
436 }
437 else
438 {
439 this->logger->log(this->logger,ERROR | LEVEL1,"IKE SA not stored in known IKE_SA list");
440 /* looks like there is no such IKE_SA, better luck next time... */
441 /* DON'T use return, we must unlock the mutex! */
442 retval = NOT_FOUND;
443 }
444 }
445 else if ((initiator_spi_set && !responder_spi_set) && (!original_initiator))
446 {
447 /* an IKE_SA_INIT from an another endpoint,
448 * he is the initiator.
449 * For simplicity, we do NOT check for retransmitted
450 * IKE_SA_INIT-Requests here, so EVERY single IKE_SA_INIT-
451 * Request (even a retransmitted one) will result in a
452 * IKE_SA. This could be improved...
453 */
454 u_int64_t responder_spi;
455 ike_sa_entry_t *new_ike_sa_entry;
456
457
458 /* set SPIs, we are the responder */
459 responder_spi = this->get_next_spi(this);
460
461 /* we also set arguments spi, so its still valid */
462 ike_sa_id->set_responder_spi(ike_sa_id, responder_spi);
463
464 /* create entry */
465 new_ike_sa_entry = ike_sa_entry_create(ike_sa_id);
466
467 this->ike_sa_list->insert_last(this->ike_sa_list, new_ike_sa_entry);
468
469 /* check ike_sa out */
470 this->logger->log(this->logger,CONTROL | LEVEL1 ,"IKE_SA added to list of known IKE_SA's");
471 new_ike_sa_entry->checked_out = TRUE;
472 *ike_sa = new_ike_sa_entry->ike_sa;
473
474 retval = CREATED;
475 }
476 else
477 {
478 /* responder set, initiator not: here is something seriously wrong! */
479 this->logger->log(this->logger,ERROR | LEVEL1, "Invalid IKE_SA SPI's");
480 /* DON'T use return, we must unlock the mutex! */
481 retval = INVALID_ARG;
482 }
483
484 pthread_mutex_unlock(&(this->mutex));
485 /* OK, unlocked... */
486 return retval;
487 }
488
489 /**
490 * Implementation of of ike_sa_manager.checkout_by_hosts.
491 */
492 static status_t checkout_by_hosts(private_ike_sa_manager_t *this, host_t *me, host_t *other, ike_sa_t **ike_sa)
493 {
494 iterator_t *iterator;
495 ike_sa_id_t *ike_sa_id = NULL;
496
497 pthread_mutex_lock(&(this->mutex));
498
499 iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
500 while (iterator->has_next(iterator))
501 {
502 ike_sa_entry_t *current;
503 host_t *sa_me, *sa_other;
504
505 iterator->current(iterator, (void**)&current);
506 sa_me = current->ike_sa->get_my_host(current->ike_sa);
507 sa_other = current->ike_sa->get_other_host(current->ike_sa);
508
509 /* one end may be default/any, but not both */
510 if (me->is_default_route(me))
511 {
512 if (other->is_default_route(other))
513 {
514 break;
515 }
516 if (other->equals(other, sa_other))
517 {
518 /* other matches */
519 ike_sa_id = current->ike_sa_id;
520 }
521 }
522 else if (other->is_default_route(other))
523 {
524 if (me->equals(me, sa_me))
525 {
526 /* ME matches */
527 ike_sa_id = current->ike_sa_id;
528 }
529 }
530 else
531 {
532 if (me->equals(me, sa_me) && other->equals(other, sa_other))
533 {
534 /* both matches */
535 ike_sa_id = current->ike_sa_id;
536 }
537 }
538 }
539 iterator->destroy(iterator);
540 pthread_mutex_unlock(&(this->mutex));
541
542 if (ike_sa_id)
543 {
544 /* checkout is done in the checkout function, since its rather complex */
545 return checkout(this, ike_sa_id, ike_sa);
546 }
547 return NOT_FOUND;
548 }
549
550 /**
551 * Implementation of ike_sa_manager_t.get_ike_sa_list.
552 */
553 linked_list_t *get_ike_sa_list(private_ike_sa_manager_t* this)
554 {
555 linked_list_t *list;
556 iterator_t *iterator;
557
558 pthread_mutex_lock(&(this->mutex));
559
560 list = linked_list_create();
561 iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
562 while (iterator->has_next(iterator))
563 {
564 ike_sa_entry_t *entry;
565 iterator->current(iterator, (void**)&entry);
566 list->insert_last(list, (void*)entry->ike_sa_id->clone(entry->ike_sa_id));
567 }
568 iterator->destroy(iterator);
569
570 pthread_mutex_unlock(&(this->mutex));
571 return list;
572 }
573
574 /**
575 * Implementation of ike_sa_manager_t.get_ike_sa_list_by_name.
576 */
577 linked_list_t *get_ike_sa_list_by_name(private_ike_sa_manager_t* this, const char *name)
578 {
579 linked_list_t *list;
580 iterator_t *iterator;
581
582 pthread_mutex_lock(&(this->mutex));
583
584 list = linked_list_create();
585 iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
586 while (iterator->has_next(iterator))
587 {
588 ike_sa_entry_t *entry;
589 connection_t *connection;
590
591 iterator->current(iterator, (void**)&entry);
592 connection = entry->ike_sa->get_connection(entry->ike_sa);
593 if (strcmp(name, connection->get_name(connection)) == 0)
594 {
595 list->insert_last(list, (void*)entry->ike_sa_id->clone(entry->ike_sa_id));
596 }
597 }
598 iterator->destroy(iterator);
599
600 pthread_mutex_unlock(&(this->mutex));
601 return list;
602 }
603
604 /**
605 * Implementation of ike_sa_manager_t.log_status.
606 */
607 static void log_status(private_ike_sa_manager_t* this, logger_t* logger, char* name)
608 {
609 iterator_t *iterator;
610
611 pthread_mutex_lock(&(this->mutex));
612
613 iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
614 while (iterator->has_next(iterator))
615 {
616 ike_sa_entry_t *entry;
617 iterator->current(iterator, (void**)&entry);
618 entry->ike_sa->log_status(entry->ike_sa, logger, name);
619 }
620 iterator->destroy(iterator);
621
622 pthread_mutex_unlock(&(this->mutex));
623 }
624
625 /**
626 * Implementation of ike_sa_manager_t.checkin.
627 */
628 static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
629 {
630 /* to check the SA back in, we look for the pointer of the ike_sa
631 * in all entries.
632 * We can't search by SPI's since the MAY have changed (e.g. on reception
633 * of a IKE_SA_INIT response). Updating of the SPI MAY be necessary...
634 */
635 status_t retval;
636 ike_sa_entry_t *entry;
637
638 pthread_mutex_lock(&(this->mutex));
639
640 /* look for the entry */
641 if (this->get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
642 {
643 /* ike_sa_id must be updated */
644 entry->ike_sa_id->replace_values(entry->ike_sa_id, ike_sa->get_id(ike_sa));
645 /* signal waiting threads */
646 entry->checked_out = FALSE;
647 this->logger->log(this->logger,CONTROL | LEVEL1,"Checkin of IKE_SA successful.");
648 pthread_cond_signal(&(entry->condvar));
649 retval = SUCCESS;
650 }
651 else
652 {
653 this->logger->log(this->logger,ERROR,"Fatal Error: Tried to checkin nonexisting IKE_SA");
654 /* this SA is no more, this REALLY should not happen */
655 retval = NOT_FOUND;
656 }
657 pthread_mutex_unlock(&(this->mutex));
658 return retval;
659 }
660
661
662 /**
663 * Implementation of ike_sa_manager_t.checkin_and_delete.
664 */
665 static status_t checkin_and_delete(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
666 {
667 /* deletion is a bit complex, we must garant that no thread is waiting for
668 * this SA.
669 * We take this SA from the list, and start signaling while threads
670 * are in the condvar.
671 */
672 ike_sa_entry_t *entry;
673 status_t retval;
674
675 pthread_mutex_lock(&(this->mutex));
676
677 if (this->get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
678 {
679 /* mark it, so now new threads can acquire this SA */
680 entry->driveout_new_threads = TRUE;
681 /* additionaly, drive out waiting threads */
682 entry->driveout_waiting_threads = TRUE;
683
684 /* wait until all workers have done their work */
685 while (entry->waiting_threads > 0)
686 {
687 /* let the other threads do some work*/
688 pthread_cond_signal(&(entry->condvar));
689 /* and the nice thing, they will wake us again when their work is done */
690 pthread_cond_wait(&(entry->condvar), &(this->mutex));
691 }
692 /* ok, we are alone now, no threads waiting in the entry's condvar */
693 this->delete_entry(this, entry);
694 this->logger->log(this->logger,CONTROL | LEVEL1,"Checkin and delete of IKE_SA successful");
695 retval = SUCCESS;
696 }
697 else
698 {
699 this->logger->log(this->logger,ERROR,"Fatal Error: Tried to checkin and delete nonexisting IKE_SA");
700 retval = NOT_FOUND;
701 }
702
703 pthread_mutex_unlock(&(this->mutex));
704 return retval;
705 }
706
707 /**
708 * Implementation of ike_sa_manager_t.delete.
709 */
710 static status_t delete(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
711 {
712 /* deletion is a bit complex, we must garant that no thread is waiting for
713 * this SA.
714 * We take this SA from the list, and start signaling while threads
715 * are in the condvar.
716 */
717 ike_sa_entry_t *entry;
718 status_t retval;
719
720 pthread_mutex_lock(&(this->mutex));
721
722 if (this->get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
723 {
724 /* mark it, so now new threads can acquire this SA */
725 entry->driveout_new_threads = TRUE;
726
727 /* wait until all workers have done their work */
728 while (entry->waiting_threads)
729 {
730 /* wake up all */
731 pthread_cond_signal(&(entry->condvar));
732 /* and the nice thing, they will wake us again when their work is done */
733 pthread_cond_wait(&(entry->condvar), &(this->mutex));
734 }
735 /* ok, we are alone now, no threads waiting in the entry's condvar */
736 this->delete_entry(this, entry);
737 this->logger->log(this->logger,CONTROL | LEVEL1,"Delete of IKE_SA successful");
738 retval = SUCCESS;
739 }
740 else
741 {
742 this->logger->log(this->logger,ERROR,"Fatal Error: Tried to delete nonexisting IKE_SA");
743 retval = NOT_FOUND;
744 }
745
746 pthread_mutex_unlock(&(this->mutex));
747 return retval;
748 }
749
750 /**
751 * Implementation of ike_sa_manager_t.destroy.
752 */
753 static void destroy(private_ike_sa_manager_t *this)
754 {
755 /* destroy all list entries */
756 linked_list_t *list = this->ike_sa_list;
757 iterator_t *iterator;
758 ike_sa_entry_t *entry;
759
760 pthread_mutex_lock(&(this->mutex));
761
762 this->logger->log(this->logger,CONTROL | LEVEL1,"Going to destroy IKE_SA manager and all managed IKE_SA's");
763
764 /* Step 1: drive out all waiting threads */
765 iterator = list->create_iterator(list, TRUE);
766
767 this->logger->log(this->logger,CONTROL | LEVEL2,"Set driveout flags for all stored IKE_SA's");
768 while (iterator->has_next(iterator))
769 {
770 iterator->current(iterator, (void**)&entry);
771 /* do not accept new threads, drive out waiting threads */
772 entry->driveout_new_threads = TRUE;
773 entry->driveout_waiting_threads = TRUE;
774 }
775
776 this->logger->log(this->logger,CONTROL | LEVEL2,"Wait for all threads to leave IKE_SA's");
777 /* Step 2: wait until all are gone */
778 iterator->reset(iterator);
779 while (iterator->has_next(iterator))
780 {
781 iterator->current(iterator, (void**)&entry);
782 while (entry->waiting_threads)
783 {
784 /* wake up all */
785 pthread_cond_signal(&(entry->condvar));
786 /* go sleeping until they are gone */
787 pthread_cond_wait(&(entry->condvar), &(this->mutex));
788 }
789 }
790 this->logger->log(this->logger,CONTROL | LEVEL2,"Delete all IKE_SA's");
791 /* Step 3: delete all entries */
792 iterator->destroy(iterator);
793
794 while (list->get_count(list) > 0)
795 {
796 list->get_first(list, (void**)&entry);
797 this->delete_entry(this, entry);
798 }
799 list->destroy(list);
800 this->logger->log(this->logger,CONTROL | LEVEL2,"IKE_SA's deleted");
801 pthread_mutex_unlock(&(this->mutex));
802
803 this->randomizer->destroy(this->randomizer);
804
805 free(this);
806 }
807
808 /*
809 * Described in header.
810 */
811 ike_sa_manager_t *ike_sa_manager_create()
812 {
813 private_ike_sa_manager_t *this = malloc_thing(private_ike_sa_manager_t);
814
815 /* assign public functions */
816 this->public.destroy = (void(*)(ike_sa_manager_t*))destroy;
817 this->public.create_and_checkout = (void(*)(ike_sa_manager_t*,ike_sa_t**))create_and_checkout;
818 this->public.checkout = (status_t(*)(ike_sa_manager_t*, ike_sa_id_t*,ike_sa_t**))checkout;
819 this->public.checkout_by_hosts = (status_t(*)(ike_sa_manager_t*,host_t*,host_t*,ike_sa_t**))checkout_by_hosts;
820 this->public.get_ike_sa_list = (linked_list_t*(*)(ike_sa_manager_t*))get_ike_sa_list;
821 this->public.get_ike_sa_list_by_name = (linked_list_t*(*)(ike_sa_manager_t*,const char*))get_ike_sa_list_by_name;
822 this->public.log_status = (void(*)(ike_sa_manager_t*,logger_t*,char*))log_status;
823 this->public.checkin = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin;
824 this->public.delete = (status_t(*)(ike_sa_manager_t*,ike_sa_id_t*))delete;
825 this->public.checkin_and_delete = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin_and_delete;
826
827 /* initialize private functions */
828 this->get_next_spi = get_next_spi;
829 this->get_entry_by_sa = get_entry_by_sa;
830 this->get_entry_by_id = get_entry_by_id;
831 this->delete_entry = delete_entry;
832
833 /* initialize private variables */
834 this->logger = logger_manager->get_logger(logger_manager, IKE_SA_MANAGER);
835
836 this->ike_sa_list = linked_list_create();
837
838 pthread_mutex_init(&(this->mutex), NULL);
839
840 this->randomizer = randomizer_create();
841
842 return (ike_sa_manager_t*)this;
843 }