src/charon/sa/ike_sa_manager.c

   1 /**
   2  * @file ike_sa_manager.c
   3  *
   4  * @brief Implementation of ike_sa_mananger_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005-2006 Martin Willi
  10  * Copyright (C) 2005 Jan Hutter
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include <pthread.h>
  25 #include <string.h>
  26
  27 #include "ike_sa_manager.h"
  28
  29 #include <daemon.h>
  30 #include <sa/ike_sa_id.h>
  31 #include <bus/bus.h>
  32 #include <utils/linked_list.h>
  33
  34 typedef struct entry_t entry_t;
  35
  36 /**
  37  * An entry in the linked list, contains IKE_SA, locking and lookup data.
  38  */
  39 struct entry_t {
  40
  41         /**
  42          * Number of threads waiting for this ike_sa_t object.
  43          */
  44         int waiting_threads;
  45
  46         /**
  47          * Condvar where threads can wait until ike_sa_t object is free for use again.
  48          */
  49         pthread_cond_t condvar;
  50
  51         /**
  52          * Is this ike_sa currently checked out?
  53          */
  54         bool checked_out;
  55
  56         /**
  57          * Does this SA drives out new threads?
  58          */
  59         bool driveout_new_threads;
  60
  61         /**
  62          * Does this SA drives out waiting threads?
  63          */
  64         bool driveout_waiting_threads;
  65
  66         /**
  67          * Identifiaction of an IKE_SA (SPIs).
  68          */
  69         ike_sa_id_t *ike_sa_id;
  70
  71         /**
  72          * The contained ike_sa_t object.
  73          */
  74         ike_sa_t *ike_sa;
  75
  76         /**
  77          * hash of the IKE_SA_INIT message, used to detect retransmissions
  78          */
  79         chunk_t init_hash;
  80
  81         /**
  82          * message ID currently processing, if any
  83          */
  84         u_int32_t message_id;
  85 };
  86
  87 /**
  88  * Implementation of entry_t.destroy.
  89  */
  90 static status_t entry_destroy(entry_t *this)
  91 {
  92         /* also destroy IKE SA */
  93         this->ike_sa->destroy(this->ike_sa);
  94         this->ike_sa_id->destroy(this->ike_sa_id);
  95         chunk_free(&this->init_hash);
  96         free(this);
  97         return SUCCESS;
  98 }
  99
 100 /**
 101  * Creates a new entry for the ike_sa_t list.
 102  */
 103 static entry_t *entry_create(ike_sa_id_t *ike_sa_id)
 104 {
 105         entry_t *this = malloc_thing(entry_t);
 106
 107         this->waiting_threads = 0;
 108         pthread_cond_init(&this->condvar, NULL);
 109
 110         /* we set checkout flag when we really give it out */
 111         this->checked_out = FALSE;
 112         this->driveout_new_threads = FALSE;
 113         this->driveout_waiting_threads = FALSE;
 114         this->message_id = -1;
 115         this->init_hash = chunk_empty;
 116
 117         /* ike_sa_id is always cloned */
 118         this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
 119
 120         /* create new ike_sa */
 121         this->ike_sa = ike_sa_create(ike_sa_id);
 122
 123         return this;
 124 }
 125
 126
 127 typedef struct private_ike_sa_manager_t private_ike_sa_manager_t;
 128
 129 /**
 130  * Additional private members of ike_sa_manager_t.
 131  */
 132 struct private_ike_sa_manager_t {
 133         /**
 134          * Public interface of ike_sa_manager_t.
 135          */
 136          ike_sa_manager_t public;
 137
 138          /**
 139           * Lock for exclusivly accessing the manager.
 140           */
 141          pthread_mutex_t mutex;
 142
 143          /**
 144           * Linked list with entries for the ike_sa_t objects.
 145           */
 146          linked_list_t *ike_sa_list;
 147
 148          /**
 149           * A randomizer, to get random SPIs for our side
 150           */
 151          randomizer_t *randomizer;
 152
 153          /**
 154           * SHA1 hasher for IKE_SA_INIT retransmit detection
 155           */
 156          hasher_t *hasher;
 157 };
 158
 159 /**
 160  * Implementation of private_ike_sa_manager_t.get_entry_by_id.
 161  */
 162 static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, entry_t **entry)
 163 {
 164         linked_list_t *list = this->ike_sa_list;
 165         iterator_t *iterator;
 166         entry_t *current;
 167         status_t status;
 168
 169         /* create iterator over list of ike_sa's */
 170         iterator = list->create_iterator(list, TRUE);
 171
 172         /* default status */
 173         status = NOT_FOUND;
 174
 175         while (iterator->iterate(iterator, (void**)&current))
 176         {
 177                 if (current->ike_sa_id->equals(current->ike_sa_id, ike_sa_id))
 178                 {
 179                         DBG2(DBG_MGR,  "found entry by both SPIs");
 180                         *entry = current;
 181                         status = SUCCESS;
 182                         break;
 183                 }
 184                 if (ike_sa_id->get_responder_spi(ike_sa_id) == 0 ||
 185                         current->ike_sa_id->get_responder_spi(current->ike_sa_id) == 0)
 186                 {
 187                         /* seems to be a half ready ike_sa */
 188                         if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) ==
 189                                                   ike_sa_id->get_initiator_spi(ike_sa_id)) &&
 190                                 (current->ike_sa_id->is_initiator(ike_sa_id) ==
 191                                                   ike_sa_id->is_initiator(current->ike_sa_id)))
 192                         {
 193                                 DBG2(DBG_MGR, "found entry by initiator SPI");
 194                                 *entry = current;
 195                                 status = SUCCESS;
 196                                 break;
 197                         }
 198                 }
 199         }
 200
 201         iterator->destroy(iterator);
 202         return status;
 203 }
 204
 205 /**
 206  * Implementation of private_ike_sa_manager_t.get_entry_by_sa.
 207  */
 208 static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa, entry_t **entry)
 209 {
 210         linked_list_t *list = this->ike_sa_list;
 211         iterator_t *iterator;
 212         entry_t *current;
 213         status_t status;
 214
 215         iterator = list->create_iterator(list, TRUE);
 216
 217         /* default status */
 218         status = NOT_FOUND;
 219
 220         while (iterator->iterate(iterator, (void**)&current))
 221         {
 222                 /* only pointers are compared */
 223                 if (current->ike_sa == ike_sa)
 224                 {
 225                         DBG2(DBG_MGR, "found entry by pointer");
 226                         *entry = current;
 227                         status = SUCCESS;
 228                         break;
 229                 }
 230         }
 231         iterator->destroy(iterator);
 232
 233         return status;
 234 }
 235
 236 /**
 237  * Implementation of private_ike_sa_manager_s.delete_entry.
 238  */
 239 static status_t delete_entry(private_ike_sa_manager_t *this, entry_t *entry)
 240 {
 241         linked_list_t *list = this->ike_sa_list;
 242         iterator_t *iterator;
 243         entry_t *current;
 244         status_t status;
 245
 246         iterator = list->create_iterator(list, TRUE);
 247
 248         status = NOT_FOUND;
 249
 250         while (iterator->iterate(iterator, (void**)&current))
 251         {
 252                 if (current == entry)
 253                 {
 254                         /* mark it, so now new threads can get this entry */
 255                         entry->driveout_new_threads = TRUE;
 256                         /* wait until all workers have done their work */
 257                         while (entry->waiting_threads)
 258                         {
 259                                 /* wake up all */
 260                                 pthread_cond_broadcast(&(entry->condvar));
 261                                 /* they will wake us again when their work is done */
 262                                 pthread_cond_wait(&(entry->condvar), &(this->mutex));
 263                         }
 264
 265                         DBG2(DBG_MGR,  "found entry by pointer, deleting it");
 266                         iterator->remove(iterator);
 267                         entry_destroy(entry);
 268                         status = SUCCESS;
 269                         break;
 270                 }
 271         }
 272         iterator->destroy(iterator);
 273         return status;
 274 }
 275
 276 /**
 277  * Wait until no other thread is using an IKE_SA, return FALSE if entry not
 278  * acquireable
 279  */
 280 static bool wait_for_entry(private_ike_sa_manager_t *this, entry_t *entry)
 281 {
 282         if (entry->driveout_new_threads)
 283         {
 284                 /* we are not allowed to get this */
 285                 return FALSE;
 286         }
 287         while (entry->checked_out && !entry->driveout_waiting_threads)
 288         {
 289                 /* so wait until we can get it for us.
 290                  * we register us as waiting. */
 291                 entry->waiting_threads++;
 292                 pthread_cond_wait(&(entry->condvar), &(this->mutex));
 293                 entry->waiting_threads--;
 294         }
 295         /* hm, a deletion request forbids us to get this SA, get next one */
 296         if (entry->driveout_waiting_threads)
 297         {
 298                 /* we must signal here, others may be waiting on it, too */
 299                 pthread_cond_signal(&(entry->condvar));
 300                 return FALSE;
 301         }
 302         return TRUE;
 303 }
 304
 305 /**
 306  * Implementation of private_ike_sa_manager_t.get_next_spi.
 307  */
 308 static u_int64_t get_next_spi(private_ike_sa_manager_t *this)
 309 {
 310         u_int64_t spi;
 311
 312         this->randomizer->get_pseudo_random_bytes(this->randomizer, sizeof(spi),
 313                                                                                           (u_int8_t*)&spi);
 314         return spi;
 315 }
 316
 317 /**
 318  * Implementation of of ike_sa_manager.checkout.
 319  */
 320 static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
 321 {
 322         ike_sa_t *ike_sa = NULL;
 323         entry_t *entry;
 324
 325         DBG2(DBG_MGR, "checkout IKE_SA, %d IKE_SAs in manager",
 326                  this->ike_sa_list->get_count(this->ike_sa_list));
 327
 328         pthread_mutex_lock(&(this->mutex));
 329         if (get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
 330         {
 331                 if (wait_for_entry(this, entry))
 332                 {
 333                         DBG2(DBG_MGR, "IKE_SA successfully checked out");
 334                         entry->checked_out = TRUE;
 335                         ike_sa = entry->ike_sa;
 336                 }
 337         }
 338         pthread_mutex_unlock(&this->mutex);
 339         charon->bus->set_sa(charon->bus, ike_sa);
 340         return ike_sa;
 341 }
 342
 343 /**
 344  * Implementation of of ike_sa_manager.checkout_new.
 345  */
 346 static ike_sa_t *checkout_new(private_ike_sa_manager_t* this, bool initiator)
 347 {
 348         entry_t *entry;
 349         ike_sa_id_t *id;
 350
 351         if (initiator)
 352         {
 353                 id = ike_sa_id_create(get_next_spi(this), 0, TRUE);
 354         }
 355         else
 356         {
 357                 id = ike_sa_id_create(0, get_next_spi(this), FALSE);
 358         }
 359         entry = entry_create(id);
 360         id->destroy(id);
 361         pthread_mutex_lock(&this->mutex);
 362         this->ike_sa_list->insert_last(this->ike_sa_list, entry);
 363         entry->checked_out = TRUE;
 364         pthread_mutex_unlock(&this->mutex);
 365         DBG2(DBG_MGR, "created IKE_SA, %d IKE_SAs in manager",
 366                  this->ike_sa_list->get_count(this->ike_sa_list));
 367         return entry->ike_sa;
 368 }
 369
 370 /**
 371  * Implementation of of ike_sa_manager.checkout_by_id.
 372  */
 373 static ike_sa_t* checkout_by_message(private_ike_sa_manager_t* this,
 374                                                                          message_t *message)
 375 {
 376         entry_t *entry;
 377         ike_sa_t *ike_sa = NULL;
 378         ike_sa_id_t *id = message->get_ike_sa_id(message);
 379         id = id->clone(id);
 380         id->switch_initiator(id);
 381
 382         DBG2(DBG_MGR, "checkout IKE_SA by message, %d IKE_SAs in manager",
 383                  this->ike_sa_list->get_count(this->ike_sa_list));
 384
 385         if (message->get_request(message) &&
 386                 message->get_exchange_type(message) == IKE_SA_INIT)
 387         {
 388                 /* IKE_SA_INIT request. Check for an IKE_SA with such a message hash. */
 389                 iterator_t *iterator;
 390                 chunk_t data, hash;
 391
 392                 data = message->get_packet_data(message);
 393                 this->hasher->allocate_hash(this->hasher, data, &hash);
 394                 chunk_free(&data);
 395
 396                 pthread_mutex_lock(&this->mutex);
 397                 iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 398                 while (iterator->iterate(iterator, (void**)&entry))
 399                 {
 400                         if (chunk_equals(hash, entry->init_hash))
 401                         {
 402                                 if (entry->message_id == 0)
 403                                 {
 404                                         iterator->destroy(iterator);
 405                                         pthread_mutex_unlock(&this->mutex);
 406                                         chunk_free(&hash);
 407                                         id->destroy(id);
 408                                         DBG1(DBG_MGR, "ignoring IKE_SA_INIT, already processing");
 409                                         return NULL;
 410                                 }
 411                                 else if (wait_for_entry(this, entry))
 412                                 {
 413                                         DBG2(DBG_MGR, "IKE_SA checked out by hash");
 414                                         entry->checked_out = TRUE;
 415                                         entry->message_id = message->get_message_id(message);
 416                                         ike_sa = entry->ike_sa;
 417                                 }
 418                                 break;
 419                         }
 420                 }
 421                 iterator->destroy(iterator);
 422                 pthread_mutex_unlock(&this->mutex);
 423
 424                 if (ike_sa == NULL)
 425                 {
 426                         if (id->get_responder_spi(id) == 0 &&
 427                                 message->get_exchange_type(message) == IKE_SA_INIT)
 428                         {
 429                                 /* no IKE_SA found, create a new one */
 430                                 id->set_responder_spi(id, get_next_spi(this));
 431                                 entry = entry_create(id);
 432
 433                                 pthread_mutex_lock(&this->mutex);
 434                                 this->ike_sa_list->insert_last(this->ike_sa_list, entry);
 435                                 entry->checked_out = TRUE;
 436                                 entry->message_id = message->get_message_id(message);
 437                                 pthread_mutex_unlock(&this->mutex);
 438                                 entry->init_hash = hash;
 439                                 ike_sa = entry->ike_sa;
 440                         }
 441                         else
 442                         {
 443                                 chunk_free(&hash);
 444                                 DBG1(DBG_MGR, "ignoring message, no such IKE_SA");
 445                         }
 446                 }
 447                 else
 448                 {
 449                         chunk_free(&hash);
 450                 }
 451                 id->destroy(id);
 452                 charon->bus->set_sa(charon->bus, ike_sa);
 453                 return ike_sa;
 454         }
 455
 456         pthread_mutex_lock(&(this->mutex));
 457         if (get_entry_by_id(this, id, &entry) == SUCCESS)
 458         {
 459                 /* only check out if we are not processing this request */
 460                 if (message->get_request(message) &&
 461                         message->get_message_id(message) == entry->message_id)
 462                 {
 463                         DBG1(DBG_MGR, "ignoring request with ID %d, already processing",
 464                                  entry->message_id);
 465                 }
 466                 else if (wait_for_entry(this, entry))
 467                 {
 468                         ike_sa_id_t *ike_id = entry->ike_sa->get_id(entry->ike_sa);
 469                         DBG2(DBG_MGR, "IKE_SA successfully checked out");
 470                         entry->checked_out = TRUE;
 471                         entry->message_id = message->get_message_id(message);
 472                         if (ike_id->get_responder_spi(ike_id) == 0)
 473                         {
 474                                 ike_id->set_responder_spi(ike_id, id->get_responder_spi(id));
 475                         }
 476                         ike_sa = entry->ike_sa;
 477                 }
 478         }
 479         pthread_mutex_unlock(&this->mutex);
 480         id->destroy(id);
 481         charon->bus->set_sa(charon->bus, ike_sa);
 482         return ike_sa;
 483 }
 484
 485 /**
 486  * Implementation of of ike_sa_manager.checkout_by_id.
 487  */
 488 static ike_sa_t* checkout_by_peer(private_ike_sa_manager_t *this,
 489                                                                   host_t *my_host, host_t *other_host,
 490                                                                   identification_t *my_id,
 491                                                                   identification_t *other_id)
 492 {
 493         iterator_t *iterator;
 494         entry_t *entry;
 495         ike_sa_t *ike_sa = NULL;
 496
 497         pthread_mutex_lock(&(this->mutex));
 498
 499         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 500         while (iterator->iterate(iterator, (void**)&entry))
 501         {
 502                 identification_t *found_my_id, *found_other_id;
 503                 host_t *found_my_host, *found_other_host;
 504                 int wc;
 505
 506                 if (!wait_for_entry(this, entry))
 507                 {
 508                         continue;
 509                 }
 510
 511                 if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING)
 512                 {
 513                         /* skip IKE_SA which are not useable */
 514                         continue;
 515                 }
 516
 517                 found_my_id = entry->ike_sa->get_my_id(entry->ike_sa);
 518                 found_other_id = entry->ike_sa->get_other_id(entry->ike_sa);
 519                 found_my_host = entry->ike_sa->get_my_host(entry->ike_sa);
 520                 found_other_host = entry->ike_sa->get_other_host(entry->ike_sa);
 521
 522                 if (found_my_id->get_type(found_my_id) == ID_ANY &&
 523                         found_other_id->get_type(found_other_id) == ID_ANY)
 524                 {
 525                         /* IKE_SA has no IDs yet, so we can't use it */
 526                         continue;
 527                 }
 528
 529                 /* compare ID and hosts. Supplied ID may contain wildcards, and IP
 530                  * may be %any. */
 531                 if ((found_my_host->is_anyaddr(found_my_host) ||
 532                          my_host->ip_equals(my_host, found_my_host)) &&
 533                         (found_other_host->is_anyaddr(found_other_host) ||
 534                          other_host->ip_equals(other_host, found_other_host)) &&
 535                         found_my_id->matches(found_my_id, my_id, &wc) &&
 536                         found_other_id->matches(found_other_id, other_id, &wc))
 537                 {
 538                         /* looks good, we take this one */
 539                         DBG2(DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
 540                                  my_host, other_host, my_id, other_id);
 541                         entry->checked_out = TRUE;
 542                         ike_sa = entry->ike_sa;
 543                 }
 544         }
 545         iterator->destroy(iterator);
 546
 547         if (!ike_sa)
 548         {
 549                 u_int64_t initiator_spi;
 550                 entry_t *new_entry;
 551                 ike_sa_id_t *new_ike_sa_id;
 552
 553                 initiator_spi = get_next_spi(this);
 554                 new_ike_sa_id = ike_sa_id_create(0, 0, TRUE);
 555                 new_ike_sa_id->set_initiator_spi(new_ike_sa_id, initiator_spi);
 556
 557                 /* create entry */
 558                 new_entry = entry_create(new_ike_sa_id);
 559                 DBG2(DBG_MGR, "created IKE_SA");
 560                 new_ike_sa_id->destroy(new_ike_sa_id);
 561
 562                 this->ike_sa_list->insert_last(this->ike_sa_list, new_entry);
 563
 564                 /* check ike_sa out */
 565                 DBG2(DBG_MGR, "new IKE_SA created for IDs [%D]...[%D]", my_id, other_id);
 566                 new_entry->checked_out = TRUE;
 567                 ike_sa = new_entry->ike_sa;
 568         }
 569         pthread_mutex_unlock(&(this->mutex));
 570         charon->bus->set_sa(charon->bus, ike_sa);
 571         return ike_sa;
 572 }
 573
 574 /**
 575  * Implementation of of ike_sa_manager.checkout_by_id.
 576  */
 577 static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this, u_int32_t id,
 578                                                                 bool child)
 579 {
 580         iterator_t *iterator, *children;
 581         entry_t *entry;
 582         ike_sa_t *ike_sa = NULL;
 583         child_sa_t *child_sa;
 584
 585         pthread_mutex_lock(&(this->mutex));
 586
 587         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 588         while (iterator->iterate(iterator, (void**)&entry))
 589         {
 590                 if (wait_for_entry(this, entry))
 591                 {
 592                         /* look for a child with such a reqid ... */
 593                         if (child)
 594                         {
 595                                 children = entry->ike_sa->create_child_sa_iterator(entry->ike_sa);
 596                                 while (children->iterate(children, (void**)&child_sa))
 597                                 {
 598                                         if (child_sa->get_reqid(child_sa) == id)
 599                                         {
 600                                                 ike_sa = entry->ike_sa;
 601                                                 break;
 602                                         }
 603                                 }
 604                                 children->destroy(children);
 605                         }
 606                         else /* ... or for a IKE_SA with such a unique id */
 607                         {
 608                                 if (entry->ike_sa->get_unique_id(entry->ike_sa) == id)
 609                                 {
 610                                         ike_sa = entry->ike_sa;
 611                                 }
 612                         }
 613                         /* got one, return */
 614                         if (ike_sa)
 615                         {
 616                                 entry->checked_out = TRUE;
 617                                 break;
 618                         }
 619                 }
 620         }
 621         iterator->destroy(iterator);
 622         pthread_mutex_unlock(&(this->mutex));
 623
 624         charon->bus->set_sa(charon->bus, ike_sa);
 625         return ike_sa;
 626 }
 627
 628 /**
 629  * Implementation of of ike_sa_manager.checkout_by_name.
 630  */
 631 static ike_sa_t* checkout_by_name(private_ike_sa_manager_t *this, char *name,
 632                                                                   bool child)
 633 {
 634         iterator_t *iterator, *children;
 635         entry_t *entry;
 636         ike_sa_t *ike_sa = NULL;
 637         child_sa_t *child_sa;
 638
 639         pthread_mutex_lock(&(this->mutex));
 640
 641         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 642         while (iterator->iterate(iterator, (void**)&entry))
 643         {
 644                 if (wait_for_entry(this, entry))
 645                 {
 646                         /* look for a child with such a policy name ... */
 647                         if (child)
 648                         {
 649                                 children = entry->ike_sa->create_child_sa_iterator(entry->ike_sa);
 650                                 while (children->iterate(children, (void**)&child_sa))
 651                                 {
 652                                         if (streq(child_sa->get_name(child_sa), name))
 653                                         {
 654                                                 ike_sa = entry->ike_sa;
 655                                                 break;
 656                                         }
 657                                 }
 658                                 children->destroy(children);
 659                         }
 660                         else /* ... or for a IKE_SA with such a connection name */
 661                         {
 662                                 if (streq(entry->ike_sa->get_name(entry->ike_sa), name))
 663                                 {
 664                                         ike_sa = entry->ike_sa;
 665                                 }
 666                         }
 667                         /* got one, return */
 668                         if (ike_sa)
 669                         {
 670                                 entry->checked_out = TRUE;
 671                                 break;
 672                         }
 673                 }
 674         }
 675         iterator->destroy(iterator);
 676         pthread_mutex_unlock(&(this->mutex));
 677
 678         charon->bus->set_sa(charon->bus, ike_sa);
 679         return ike_sa;
 680 }
 681
 682 /**
 683  * Iterator hook for iterate, gets ike_sas instead of entries
 684  */
 685 static hook_result_t iterator_hook(private_ike_sa_manager_t* this, entry_t *in,
 686                                                                    ike_sa_t **out)
 687 {
 688         /* check out entry */
 689         if (wait_for_entry(this, in))
 690         {
 691                 *out = in->ike_sa;
 692                 return HOOK_NEXT;
 693         }
 694         return HOOK_SKIP;
 695 }
 696
 697 /**
 698  * Implementation of ike_sa_manager_t.create_iterator.
 699  */
 700 static iterator_t *create_iterator(private_ike_sa_manager_t* this)
 701 {
 702         iterator_t *iterator = this->ike_sa_list->create_iterator_locked(
 703                                                                                         this->ike_sa_list, &this->mutex);
 704         /* register hook to iterator over ike_sas, not entries */
 705         iterator->set_iterator_hook(iterator, (iterator_hook_t*)iterator_hook, this);
 706         return iterator;
 707 }
 708
 709 /**
 710  * Implementation of ike_sa_manager_t.checkin.
 711  */
 712 static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 713 {
 714         /* to check the SA back in, we look for the pointer of the ike_sa
 715          * in all entries.
 716          * We can't search by SPI's since the MAY have changed (e.g. on reception
 717          * of a IKE_SA_INIT response). Updating of the SPI MAY be necessary...
 718          */
 719         status_t retval;
 720         entry_t *entry;
 721         ike_sa_id_t *ike_sa_id;
 722
 723         ike_sa_id = ike_sa->get_id(ike_sa);
 724
 725         DBG2(DBG_MGR, "checkin IKE_SA");
 726
 727         pthread_mutex_lock(&(this->mutex));
 728
 729         /* look for the entry */
 730         if (get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
 731         {
 732                 /* ike_sa_id must be updated */
 733                 entry->ike_sa_id->replace_values(entry->ike_sa_id, ike_sa->get_id(ike_sa));
 734                 /* signal waiting threads */
 735                 entry->checked_out = FALSE;
 736                 entry->message_id = -1;
 737                 DBG2(DBG_MGR, "check-in of IKE_SA successful.");
 738                 pthread_cond_signal(&(entry->condvar));
 739                 retval = SUCCESS;
 740         }
 741         else
 742         {
 743                 DBG2(DBG_MGR, "tried to check in nonexisting IKE_SA");
 744                 /* this SA is no more, this REALLY should not happen */
 745                 retval = NOT_FOUND;
 746         }
 747
 748         DBG2(DBG_MGR, "%d IKE_SAs in manager now",
 749                  this->ike_sa_list->get_count(this->ike_sa_list));
 750         pthread_mutex_unlock(&(this->mutex));
 751
 752         charon->bus->set_sa(charon->bus, NULL);
 753         return retval;
 754 }
 755
 756
 757 /**
 758  * Implementation of ike_sa_manager_t.checkin_and_destroy.
 759  */
 760 static status_t checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 761 {
 762         /* deletion is a bit complex, we must garant that no thread is waiting for
 763          * this SA.
 764          * We take this SA from the list, and start signaling while threads
 765          * are in the condvar.
 766          */
 767         entry_t *entry;
 768         status_t retval;
 769         ike_sa_id_t *ike_sa_id;
 770
 771         ike_sa_id = ike_sa->get_id(ike_sa);
 772         DBG2(DBG_MGR, "checkin and destroy IKE_SA");
 773
 774         pthread_mutex_lock(&(this->mutex));
 775
 776         if (get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
 777         {
 778                 /* drive out waiting threads, as we are in hurry */
 779                 entry->driveout_waiting_threads = TRUE;
 780
 781                 delete_entry(this, entry);
 782
 783                 DBG2(DBG_MGR, "check-in and destroy of IKE_SA successful");
 784                 retval = SUCCESS;
 785         }
 786         else
 787         {
 788                 DBG2(DBG_MGR, "tried to check-in and delete nonexisting IKE_SA");
 789                 retval = NOT_FOUND;
 790         }
 791
 792         pthread_mutex_unlock(&(this->mutex));
 793         charon->bus->set_sa(charon->bus, ike_sa);
 794         return retval;
 795 }
 796
 797 /**
 798  * Implementation of ike_sa_manager_t.get_half_open_count.
 799  */
 800 static int get_half_open_count(private_ike_sa_manager_t *this, host_t *ip)
 801 {
 802         iterator_t *iterator;
 803         entry_t *entry;
 804         int count = 0;
 805
 806         pthread_mutex_lock(&(this->mutex));
 807         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 808         while (iterator->iterate(iterator, (void**)&entry))
 809         {
 810                 /* we check if we have a responder CONNECTING IKE_SA without checkout */
 811                 if (!entry->ike_sa_id->is_initiator(entry->ike_sa_id) &&
 812                         entry->ike_sa->get_state(entry->ike_sa) == IKE_CONNECTING)
 813                 {
 814                         /* if we have a host, we have wait until no other uses the IKE_SA */
 815                         if (ip)
 816                         {
 817                                 if (wait_for_entry(this, entry) && ip->ip_equals(ip,
 818                                                                 entry->ike_sa->get_other_host(entry->ike_sa)))
 819                                 {
 820                                         count++;
 821                                 }
 822                         }
 823                         else
 824                         {
 825                                 count++;
 826                         }
 827                 }
 828         }
 829         iterator->destroy(iterator);
 830
 831         pthread_mutex_unlock(&(this->mutex));
 832         return count;
 833 }
 834
 835 /**
 836  * Implementation of ike_sa_manager_t.destroy.
 837  */
 838 static void destroy(private_ike_sa_manager_t *this)
 839 {
 840         /* destroy all list entries */
 841         linked_list_t *list = this->ike_sa_list;
 842         iterator_t *iterator;
 843         entry_t *entry;
 844
 845         pthread_mutex_lock(&(this->mutex));
 846         DBG2(DBG_MGR, "going to destroy IKE_SA manager and all managed IKE_SA's");
 847         /* Step 1: drive out all waiting threads  */
 848         DBG2(DBG_MGR, "set driveout flags for all stored IKE_SA's");
 849         iterator = list->create_iterator(list, TRUE);
 850         while (iterator->iterate(iterator, (void**)&entry))
 851         {
 852                 /* do not accept new threads, drive out waiting threads */
 853                 entry->driveout_new_threads = TRUE;
 854                 entry->driveout_waiting_threads = TRUE;
 855         }
 856         DBG2(DBG_MGR, "wait for all threads to leave IKE_SA's");
 857         /* Step 2: wait until all are gone */
 858         iterator->reset(iterator);
 859         while (iterator->iterate(iterator, (void**)&entry))
 860         {
 861                 while (entry->waiting_threads)
 862                 {
 863                         /* wake up all */
 864                         pthread_cond_broadcast(&(entry->condvar));
 865                         /* go sleeping until they are gone */
 866                         pthread_cond_wait(&(entry->condvar), &(this->mutex));
 867                 }
 868         }
 869         DBG2(DBG_MGR, "delete all IKE_SA's");
 870         /* Step 3: initiate deletion of all IKE_SAs */
 871         iterator->reset(iterator);
 872         while (iterator->iterate(iterator, (void**)&entry))
 873         {
 874                 entry->ike_sa->delete(entry->ike_sa);
 875         }
 876         iterator->destroy(iterator);
 877
 878         DBG2(DBG_MGR, "destroy all entries");
 879         /* Step 4: destroy all entries */
 880         list->destroy_function(list, (void*)entry_destroy);
 881         pthread_mutex_unlock(&(this->mutex));
 882
 883         this->randomizer->destroy(this->randomizer);
 884         this->hasher->destroy(this->hasher);
 885
 886         free(this);
 887 }
 888
 889 /*
 890  * Described in header.
 891  */
 892 ike_sa_manager_t *ike_sa_manager_create()
 893 {
 894         private_ike_sa_manager_t *this = malloc_thing(private_ike_sa_manager_t);
 895
 896         /* assign public functions */
 897         this->public.destroy = (void(*)(ike_sa_manager_t*))destroy;
 898         this->public.checkout = (ike_sa_t*(*)(ike_sa_manager_t*, ike_sa_id_t*))checkout;
 899         this->public.checkout_new = (ike_sa_t*(*)(ike_sa_manager_t*,bool))checkout_new;
 900         this->public.checkout_by_message = (ike_sa_t*(*)(ike_sa_manager_t*,message_t*))checkout_by_message;
 901         this->public.checkout_by_peer = (ike_sa_t*(*)(ike_sa_manager_t*,host_t*,host_t*,identification_t*,identification_t*))checkout_by_peer;
 902         this->public.checkout_by_id = (ike_sa_t*(*)(ike_sa_manager_t*,u_int32_t,bool))checkout_by_id;
 903         this->public.checkout_by_name = (ike_sa_t*(*)(ike_sa_manager_t*,char*,bool))checkout_by_name;
 904         this->public.create_iterator = (iterator_t*(*)(ike_sa_manager_t*))create_iterator;
 905         this->public.checkin = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin;
 906         this->public.checkin_and_destroy = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin_and_destroy;
 907         this->public.get_half_open_count = (int(*)(ike_sa_manager_t*,host_t*))get_half_open_count;
 908
 909         /* initialize private variables */
 910         this->ike_sa_list = linked_list_create();
 911         pthread_mutex_init(&this->mutex, NULL);
 912         this->randomizer = randomizer_create();
 913         this->hasher = hasher_create(HASH_SHA1);
 914
 915         return &this->public;
 916 }