reimplemented CHILD_SA rekeying & delete
[strongswan.git] / src / charon / sa / ike_sa_manager.h
1 /**
2 * @file ike_sa_manager.h
3 *
4 * @brief Interface of ike_sa_manager_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #ifndef IKE_SA_MANAGER_H_
24 #define IKE_SA_MANAGER_H_
25
26 #include <types.h>
27 #include <sa/ike_sa.h>
28 #include <utils/logger.h>
29
30
31 typedef struct ike_sa_manager_t ike_sa_manager_t;
32
33 /**
34 * @brief The IKE_SA-Manager is responsible for managing all initiated and responded IKE_SA's.
35 *
36 * To avoid access from multiple threads, IKE_SAs must be checked out from
37 * the manager, and checked in after usage.
38 * The manager also handles deletion of SAs.
39 *
40 * @todo checking of double-checkouts from the same threads would be nice.
41 * This could be done by comparing thread-ids via pthread_self()...
42 *
43 * @todo Managing of ike_sa_t objects in a hash table instead of linked list.
44 *
45 * @b Constructors:
46 * - ike_sa_manager_create()
47 *
48 * @ingroup sa
49 */
50 struct ike_sa_manager_t {
51 /**
52 * @brief Checkout an IKE_SA, create it when necesarry.
53 *
54 * Checks out a SA by its ID. An SA will be created, when:
55 * - Responder SPI is not set (when received an IKE_SA_INIT from initiator)
56 * Management of SPIs is the managers job, he will set it.
57 * This function blocks until SA is available for checkout.
58 *
59 * @warning checking out two times without checking in will
60 * result in a deadlock!
61 *
62 * @param this the manager object
63 * @param[in/out] ike_sa_id the SA identifier, will be updated
64 * @param[out] ike_sa checked out SA
65 * @returns
66 * - SUCCESS if checkout successful
67 * - NOT_FOUND when no such SA is available
68 * - CREATED if a new IKE_SA got created
69 */
70 status_t (*checkout) (ike_sa_manager_t* this, ike_sa_id_t *sa_id, ike_sa_t **ike_sa);
71
72 /**
73 * @brief Create and checkout an IKE_SA as original initator.
74 *
75 * Creates and checks out a SA as initiator.
76 * Management of SPIs is the managers job, he will set it.
77 *
78 * @param this the manager object
79 * @param[out] ike_sa checked out SA
80 */
81 void (*create_and_checkout) (ike_sa_manager_t* this,ike_sa_t **ike_sa);
82
83 /**
84 * @brief Check out an IKE_SA by protocol and SPI of one of its CHILD_SA.
85 *
86 * The kernel sends us expire messages for IPsec SAs. To fullfill
87 * this request, we must check out the IKE SA which contains the
88 * CHILD_SA the kernel wants to modify.
89 *
90 * @param this the manager object
91 * @param protocol protocol of the CHILD_SA
92 * @param spi SPI of the CHILD_SA
93 * @param[out] ike_sa checked out SA
94 * @return
95 * - NOT_FOUND, if no IKE SA with such a child found
96 * - SUCCESS, if ike_sa set
97 */
98 status_t (*checkout_by_child) (ike_sa_manager_t* this, protocol_id_t protocol,
99 u_int32_t spi, ike_sa_t **ike_sa);
100
101 /**
102 * @brief Get a list of all IKE_SA SAs currently set up.
103 *
104 * The resulting list with all IDs must be destroyd by
105 * the caller. There is no guarantee an ike_sa with the
106 * corrensponding ID really exists, since it may be deleted
107 * in the meantime by another thread.
108 *
109 * @param this the manager object
110 * @return a list with ike_sa_id_t s
111 */
112 linked_list_t *(*get_ike_sa_list) (ike_sa_manager_t* this);
113
114 /**
115 * @brief Get a list of all IKE_SA SAs currently set up specified
116 * by the connections name.
117 *
118 * @param this the manager object
119 * @return a list with ike_sa_id_t s
120 */
121 linked_list_t *(*get_ike_sa_list_by_name) (ike_sa_manager_t* this, const char *name);
122
123 /**
124 * @brief Log the status of the IKE_SA's in the manager.
125 *
126 * A informational log is done to the supplied logger. If logger is
127 * NULL, an internal logger is used. If a name is supplied,
128 * only connections with the matching name will be logged.
129 *
130 * @param this the manager object
131 * @param logger logger to do the log, or NULL
132 * @param name name of a connection, or NULL
133 */
134 void (*log_status) (ike_sa_manager_t* this, logger_t* logger, char* name);
135
136 /**
137 * @brief Checkin the SA after usage.
138 *
139 * @warning the SA pointer MUST NOT be used after checkin!
140 * The SA must be checked out again!
141 *
142 * @param this the manager object
143 * @param[in/out] ike_sa_id the SA identifier, will be updated
144 * @param[out] ike_sa checked out SA
145 * @returns
146 * - SUCCESS if checked in
147 * - NOT_FOUND when not found (shouldn't happen!)
148 */
149 status_t (*checkin) (ike_sa_manager_t* this, ike_sa_t *ike_sa);
150
151 /**
152 * @brief Delete a SA, which was not checked out.
153 *
154 * If the state allows it, the IKE SA is destroyed immediately. If it is
155 * in the state ike_sa_established or further, a delete message
156 * is sent to the remote peer, which has to be acknowledged.
157 *
158 * @warning do not use this when the SA is already checked out, this will
159 * deadlock!
160 *
161 * @param this the manager object
162 * @param[in/out] ike_sa_id the SA identifier
163 * @returns
164 * - SUCCESS if found
165 * - NOT_FOUND when no such SA is available
166 */
167 status_t (*delete) (ike_sa_manager_t* this, ike_sa_id_t *ike_sa_id);
168
169 /**
170 * @brief Destroy a checked out SA.
171 *
172 * The IKE SA is destroyed without notification of the remote peer.
173 * Use this only if the other peer doesn't respond or behaves not
174 * as predicted.
175 * Checking in and destruction is an atomic operation (for the IKE_SA),
176 * so this can be called if the SA is in a "unclean" state, without the
177 * risk that another thread can get the SA.
178 *
179 * @param this the manager object
180 * @param ike_sa SA to delete
181 * @returns
182 * - SUCCESS if found
183 * - NOT_FOUND when no such SA is available
184 */
185 status_t (*checkin_and_destroy) (ike_sa_manager_t* this, ike_sa_t *ike_sa);
186
187 /**
188 * @brief Destroys the manager with all associated SAs.
189 *
190 * Threads will be driven out, so all SAs can be deleted cleanly.
191 *
192 * @param this the manager object
193 */
194 void (*destroy) (ike_sa_manager_t *this);
195 };
196
197 /**
198 * @brief Create a manager.
199 *
200 * @returns ike_sa_manager_t object
201 *
202 * @ingroup sa
203 */
204 ike_sa_manager_t *ike_sa_manager_create(void);
205
206 #endif /*IKE_SA_MANAGER_H_*/