implemented reauthentication using the new reauth=yes|no parameter
[strongswan.git] / src / charon / sa / ike_sa_manager.h
1 /**
2 * @file ike_sa_manager.h
3 *
4 * @brief Interface of ike_sa_manager_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005-2006 Martin Willi
10 * Copyright (C) 2005 Jan Hutter
11 * Hochschule fuer Technik Rapperswil
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 *
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * for more details.
22 */
23
24 #ifndef IKE_SA_MANAGER_H_
25 #define IKE_SA_MANAGER_H_
26
27 typedef struct ike_sa_manager_t ike_sa_manager_t;
28
29 #include <library.h>
30 #include <sa/ike_sa.h>
31
32 /**
33 * @brief The IKE_SA-Manager is responsible for managing all initiated and responded IKE_SA's.
34 *
35 * To avoid access from multiple threads, IKE_SAs must be checked out from
36 * the manager, and checked in after usage.
37 * The manager also handles deletion of SAs.
38 *
39 * @todo checking of double-checkouts from the same threads would be nice.
40 * This could be done by comparing thread-ids via pthread_self()...
41 *
42 * @todo Managing of ike_sa_t objects in a hash table instead of linked list.
43 *
44 * @b Constructors:
45 * - ike_sa_manager_create()
46 *
47 * @ingroup sa
48 */
49 struct ike_sa_manager_t {
50 /**
51 * @brief Checkout an IKE_SA, create it when necesarry.
52 *
53 * Checks out a SA by its ID. An SA will be created, when the responder
54 * SPI is not set (when received an IKE_SA_INIT from initiator).
55 * Management of SPIs is the managers job, he will set it.
56 * This function blocks until SA is available for checkout.
57 *
58 * @warning checking out two times without checking in will
59 * result in a deadlock!
60 *
61 * @param this the manager object
62 * @param[in/out] ike_sa_id the SA identifier, will be updated
63 * @returns
64 * - checked out IKE_SA if found
65 * - NULL, if no such IKE_SA available
66 */
67 ike_sa_t* (*checkout) (ike_sa_manager_t* this, ike_sa_id_t *sa_id);
68
69 /**
70 * @brief Checkout an existing IKE_SA by hosts and identifications.
71 *
72 * Allows the lookup of an IKE_SA by user IDs and hosts. It returns the
73 * first found occurence, if there are multiple candidates. Supplied IDs
74 * may contain wildcards, hosts may be %any.
75 * If no IKE_SA is found, a new one is created. This is also the case when
76 * the found IKE_SA is in the DELETING state.
77 *
78 * @param this the manager object
79 * @param my_host address of our host
80 * @param other_id address of remote host
81 * @param my_id ID used by us
82 * @param other_id ID used by remote
83 * @return checked out/created IKE_SA
84 */
85 ike_sa_t* (*checkout_by_id) (ike_sa_manager_t* this,
86 host_t *my_host, host_t* other_host,
87 identification_t *my_id,
88 identification_t *other_id);
89
90 /**
91 * @brief Check out an IKE_SA by protocol and SPI of one of its CHILD_SA.
92 *
93 * The kernel sends us expire messages for IPsec SAs. To fullfill
94 * this request, we must check out the IKE SA which contains the
95 * CHILD_SA the kernel wants to modify.
96 *
97 * @param this the manager object
98 * @param reqid reqid of the CHILD_SA
99 * @return
100 * - checked out IKE_SA, if found
101 * - NULL, if not found
102 */
103 ike_sa_t* (*checkout_by_child) (ike_sa_manager_t* this, u_int32_t reqid);
104
105 /**
106 * @brief Create an iterator over all stored IKE_SAs.
107 *
108 * The avoid synchronization issues, the iterator locks access
109 * to the manager exclusively, until it gets destroyed.
110 * This iterator is for reading only! Writing will corrupt the manager.
111 *
112 * @param this the manager object
113 * @return iterator over all IKE_SAs.
114 */
115 iterator_t *(*create_iterator) (ike_sa_manager_t* this);
116
117 /**
118 * @brief Checkin the SA after usage.
119 *
120 * @warning the SA pointer MUST NOT be used after checkin!
121 * The SA must be checked out again!
122 *
123 * @param this the manager object
124 * @param[in/out] ike_sa_id the SA identifier, will be updated
125 * @param[out] ike_sa checked out SA
126 * @returns
127 * - SUCCESS if checked in
128 * - NOT_FOUND when not found (shouldn't happen!)
129 */
130 status_t (*checkin) (ike_sa_manager_t* this, ike_sa_t *ike_sa);
131
132 /**
133 * @brief Delete a SA, which was not checked out.
134 *
135 * If the state allows it, the IKE SA is destroyed immediately. If it is
136 * in the state ESTABLSIHED, a delete message
137 * is sent to the remote peer, which has to be acknowledged.
138 *
139 * @warning do not use this when the SA is already checked out, this will
140 * deadlock!
141 *
142 * @param this the manager object
143 * @param[in/out] ike_sa_id the SA identifier
144 * @returns
145 * - SUCCESS if found
146 * - NOT_FOUND when no such SA is available
147 */
148 status_t (*delete) (ike_sa_manager_t* this, ike_sa_id_t *ike_sa_id);
149
150 /**
151 * @brief Delete a SA identified by its name, which was not checked out.
152 *
153 * Using delete_by_name allows the delete of IKE_SAs and CHILD_SAs.
154 * The supplied name may have one of the following format:
155 *
156 * name{x} => delete IKE_SA with "name" and unique id "x"
157 * name{} => delete all IKE_SAs with "name"
158 * name[x] => delete CHILD_SA with "name" and unique id "x"
159 * name[] => delete all CHILD_SAs with "name"
160 * name => delete all CHILD_SAs or IKE_SAs with "name"
161 *
162 * @warning do not use this when the SA is already checked out, this will
163 * deadlock!
164 *
165 * @param this the manager object
166 * @param name name in one of the format described above
167 * @returns
168 * - SUCCESS if found
169 * - NOT_FOUND when no such SA is available
170 */
171 status_t (*delete_by_name) (ike_sa_manager_t* this, char *name);
172
173 /**
174 * @brief Destroy a checked out SA.
175 *
176 * The IKE SA is destroyed without notification of the remote peer.
177 * Use this only if the other peer doesn't respond or behaves not
178 * as predicted.
179 * Checking in and destruction is an atomic operation (for the IKE_SA),
180 * so this can be called if the SA is in a "unclean" state, without the
181 * risk that another thread can get the SA.
182 *
183 * @param this the manager object
184 * @param ike_sa SA to delete
185 * @returns
186 * - SUCCESS if found
187 * - NOT_FOUND when no such SA is available
188 */
189 status_t (*checkin_and_destroy) (ike_sa_manager_t* this, ike_sa_t *ike_sa);
190
191 /**
192 * @brief Destroys the manager with all associated SAs.
193 *
194 * Threads will be driven out, so all SAs can be deleted cleanly.
195 *
196 * @param this the manager object
197 */
198 void (*destroy) (ike_sa_manager_t *this);
199 };
200
201 /**
202 * @brief Create a manager.
203 *
204 * @returns ike_sa_manager_t object
205 *
206 * @ingroup sa
207 */
208 ike_sa_manager_t *ike_sa_manager_create(void);
209
210 #endif /*IKE_SA_MANAGER_H_*/