add priority management for kernel policy
[strongswan.git] / src / charon / sa / ike_sa_manager.h
1 /**
2 * @file ike_sa_manager.h
3 *
4 * @brief Interface of ike_sa_manager_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005-2006 Martin Willi
10 * Copyright (C) 2005 Jan Hutter
11 * Hochschule fuer Technik Rapperswil
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 *
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * for more details.
22 */
23
24 #ifndef IKE_SA_MANAGER_H_
25 #define IKE_SA_MANAGER_H_
26
27 #include <types.h>
28 #include <sa/ike_sa.h>
29 #include <utils/logger.h>
30
31
32 typedef struct ike_sa_manager_t ike_sa_manager_t;
33
34 /**
35 * @brief The IKE_SA-Manager is responsible for managing all initiated and responded IKE_SA's.
36 *
37 * To avoid access from multiple threads, IKE_SAs must be checked out from
38 * the manager, and checked in after usage.
39 * The manager also handles deletion of SAs.
40 *
41 * @todo checking of double-checkouts from the same threads would be nice.
42 * This could be done by comparing thread-ids via pthread_self()...
43 *
44 * @todo Managing of ike_sa_t objects in a hash table instead of linked list.
45 *
46 * @b Constructors:
47 * - ike_sa_manager_create()
48 *
49 * @ingroup sa
50 */
51 struct ike_sa_manager_t {
52 /**
53 * @brief Checkout an IKE_SA, create it when necesarry.
54 *
55 * Checks out a SA by its ID. An SA will be created, when the responder
56 * SPI is not set (when received an IKE_SA_INIT from initiator).
57 * Management of SPIs is the managers job, he will set it.
58 * This function blocks until SA is available for checkout.
59 *
60 * @warning checking out two times without checking in will
61 * result in a deadlock!
62 *
63 * @param this the manager object
64 * @param[in/out] ike_sa_id the SA identifier, will be updated
65 * @returns
66 * - checked out IKE_SA if found
67 * - NULL, if no such IKE_SA available
68 */
69 ike_sa_t* (*checkout) (ike_sa_manager_t* this, ike_sa_id_t *sa_id);
70
71 /**
72 * @brief Checkout an existing IKE_SA by hosts and identifications.
73 *
74 * Allows the lookup of an IKE_SA by user IDs and hosts. It returns the
75 * first found occurence, if there are multiple candidates. Supplied IDs
76 * may contain wildcards, hosts may be %any.
77 * If no IKE_SA is found, a new one is created.
78 *
79 * @param this the manager object
80 * @param my_host address of our host
81 * @param other_id address of remote host
82 * @param my_id ID used by us
83 * @param other_id ID used by remote
84 * @return checked out/created IKE_SA
85 */
86 ike_sa_t* (*checkout_by_id) (ike_sa_manager_t* this,
87 host_t *my_host, host_t* other_host,
88 identification_t *my_id,
89 identification_t *other_id);
90
91 /**
92 * @brief Check out an IKE_SA by protocol and SPI of one of its CHILD_SA.
93 *
94 * The kernel sends us expire messages for IPsec SAs. To fullfill
95 * this request, we must check out the IKE SA which contains the
96 * CHILD_SA the kernel wants to modify.
97 *
98 * @param this the manager object
99 * @param reqid reqid of the CHILD_SA
100 * @return
101 * - checked out IKE_SA, if found
102 * - NULL, if not found
103 */
104 ike_sa_t* (*checkout_by_child) (ike_sa_manager_t* this, u_int32_t reqid);
105
106 /**
107 * @brief Get a list of all IKE_SA SAs currently set up.
108 *
109 * The resulting list with all IDs must be destroyed by
110 * the caller. There is no guarantee an ike_sa with the
111 * corrensponding ID really exists, since it may be deleted
112 * in the meantime by another thread.
113 *
114 * @param this the manager object
115 * @return a list with ike_sa_id_t s
116 */
117 linked_list_t *(*get_ike_sa_list) (ike_sa_manager_t* this);
118
119 /**
120 * @brief Log the status of the IKE_SA's in the manager.
121 *
122 * A informational log is done to the supplied logger. If logger is
123 * NULL, an internal logger is used. If a name is supplied,
124 * only connections with the matching name will be logged.
125 *
126 * @param this the manager object
127 * @param logger logger to do the log, or NULL
128 * @param name name of a connection, or NULL
129 */
130 void (*log_status) (ike_sa_manager_t* this, logger_t* logger, char* name);
131
132 /**
133 * @brief Checkin the SA after usage.
134 *
135 * @warning the SA pointer MUST NOT be used after checkin!
136 * The SA must be checked out again!
137 *
138 * @param this the manager object
139 * @param[in/out] ike_sa_id the SA identifier, will be updated
140 * @param[out] ike_sa checked out SA
141 * @returns
142 * - SUCCESS if checked in
143 * - NOT_FOUND when not found (shouldn't happen!)
144 */
145 status_t (*checkin) (ike_sa_manager_t* this, ike_sa_t *ike_sa);
146
147 /**
148 * @brief Delete a SA, which was not checked out.
149 *
150 * If the state allows it, the IKE SA is destroyed immediately. If it is
151 * in the state ESTABLSIHED, a delete message
152 * is sent to the remote peer, which has to be acknowledged.
153 *
154 * @warning do not use this when the SA is already checked out, this will
155 * deadlock!
156 *
157 * @param this the manager object
158 * @param[in/out] ike_sa_id the SA identifier
159 * @returns
160 * - SUCCESS if found
161 * - NOT_FOUND when no such SA is available
162 */
163 status_t (*delete) (ike_sa_manager_t* this, ike_sa_id_t *ike_sa_id);
164
165 /**
166 * @brief Delete a SA identified by its name, which was not checked out.
167 *
168 * Using delete_by_name allows the delete of IKE_SAs and CHILD_SAs.
169 * The supplied name may have one of the following format:
170 *
171 * name{x} => delete IKE_SA with "name" and unique id "x"
172 * name{} => delete all IKE_SAs with "name"
173 * name[x] => delete CHILD_SA with "name" and unique id "x"
174 * name[] => delete all CHILD_SAs with "name"
175 * name => delete all CHILD_SAs or IKE_SAs with "name"
176 *
177 * @warning do not use this when the SA is already checked out, this will
178 * deadlock!
179 *
180 * @param this the manager object
181 * @param name name in one of the format described above
182 * @returns
183 * - SUCCESS if found
184 * - NOT_FOUND when no such SA is available
185 */
186 status_t (*delete_by_name) (ike_sa_manager_t* this, char *name);
187
188 /**
189 * @brief Destroy a checked out SA.
190 *
191 * The IKE SA is destroyed without notification of the remote peer.
192 * Use this only if the other peer doesn't respond or behaves not
193 * as predicted.
194 * Checking in and destruction is an atomic operation (for the IKE_SA),
195 * so this can be called if the SA is in a "unclean" state, without the
196 * risk that another thread can get the SA.
197 *
198 * @param this the manager object
199 * @param ike_sa SA to delete
200 * @returns
201 * - SUCCESS if found
202 * - NOT_FOUND when no such SA is available
203 */
204 status_t (*checkin_and_destroy) (ike_sa_manager_t* this, ike_sa_t *ike_sa);
205
206 /**
207 * @brief Destroys the manager with all associated SAs.
208 *
209 * Threads will be driven out, so all SAs can be deleted cleanly.
210 *
211 * @param this the manager object
212 */
213 void (*destroy) (ike_sa_manager_t *this);
214 };
215
216 /**
217 * @brief Create a manager.
218 *
219 * @returns ike_sa_manager_t object
220 *
221 * @ingroup sa
222 */
223 ike_sa_manager_t *ike_sa_manager_create(void);
224
225 #endif /*IKE_SA_MANAGER_H_*/