3aed41418ce85feb16c67dc0da4cfe73bb5ef43c
[strongswan.git] / src / libcharon / control / controller.c
1 /*
2 * Copyright (C) 2011-2015 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Copyright (C) 2011 revosec AG
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include "controller.h"
19
20 #include <sys/types.h>
21 #include <dirent.h>
22 #include <sys/stat.h>
23
24 #include <daemon.h>
25 #include <library.h>
26 #include <threading/thread.h>
27 #include <threading/spinlock.h>
28 #include <threading/semaphore.h>
29
30 typedef struct private_controller_t private_controller_t;
31 typedef struct interface_listener_t interface_listener_t;
32 typedef struct interface_logger_t interface_logger_t;
33
34 /**
35 * Private data of an stroke_t object.
36 */
37 struct private_controller_t {
38
39 /**
40 * Public part of stroke_t object.
41 */
42 controller_t public;
43 };
44
45 /**
46 * helper struct for the logger interface
47 */
48 struct interface_logger_t {
49 /**
50 * public logger interface
51 */
52 logger_t public;
53
54 /**
55 * reference to the listener
56 */
57 interface_listener_t *listener;
58
59 /**
60 * interface callback (listener gets redirected to here)
61 */
62 controller_cb_t callback;
63
64 /**
65 * user parameter to pass to callback
66 */
67 void *param;
68 };
69
70 /**
71 * helper struct to map listener callbacks to interface callbacks
72 */
73 struct interface_listener_t {
74
75 /**
76 * public bus listener interface
77 */
78 listener_t public;
79
80 /**
81 * logger interface
82 */
83 interface_logger_t logger;
84
85 /**
86 * status of the operation, return to method callers
87 */
88 status_t status;
89
90 /**
91 * child configuration, used for initiate
92 */
93 child_cfg_t *child_cfg;
94
95 /**
96 * peer configuration, used for initiate
97 */
98 peer_cfg_t *peer_cfg;
99
100 /**
101 * IKE_SA to handle
102 */
103 ike_sa_t *ike_sa;
104
105 /**
106 * unique ID, used for various methods
107 */
108 uint32_t id;
109
110 /**
111 * semaphore to implement wait_for_listener()
112 */
113 semaphore_t *done;
114
115 /**
116 * spinlock to update the IKE_SA handle properly
117 */
118 spinlock_t *lock;
119
120 /**
121 * whether to check limits
122 */
123 bool limits;
124 };
125
126
127 typedef struct interface_job_t interface_job_t;
128
129 /**
130 * job for asynchronous listen operations
131 */
132 struct interface_job_t {
133
134 /**
135 * job interface
136 */
137 job_t public;
138
139 /**
140 * associated listener
141 */
142 interface_listener_t listener;
143
144 /**
145 * the job is reference counted as the thread executing a job as well as
146 * the thread waiting in wait_for_listener() require it but either of them
147 * could be done first
148 */
149 refcount_t refcount;
150 };
151
152 /**
153 * This function wakes a thread that is waiting in wait_for_listener(),
154 * either from a listener or from a job.
155 */
156 static inline bool listener_done(interface_listener_t *listener)
157 {
158 if (listener->done)
159 {
160 listener->done->post(listener->done);
161 }
162 return FALSE;
163 }
164
165 /**
166 * thread_cleanup_t handler to unregister a listener.
167 */
168 static void listener_unregister(interface_listener_t *listener)
169 {
170 charon->bus->remove_listener(charon->bus, &listener->public);
171 charon->bus->remove_logger(charon->bus, &listener->logger.public);
172 }
173
174 /**
175 * Registers the listener, executes the job and then waits synchronously until
176 * the listener is done or the timeout occurred.
177 *
178 * @note Use 'return listener_done(listener)' to properly unregister a listener
179 *
180 * @param listener listener to register
181 * @param job job to execute asynchronously when registered, or NULL
182 * @param timeout max timeout in ms to listen for events, 0 to disable
183 * @return TRUE if timed out
184 */
185 static bool wait_for_listener(interface_job_t *job, u_int timeout)
186 {
187 interface_listener_t *listener = &job->listener;
188 bool old, timed_out = FALSE;
189
190 /* avoid that the job is destroyed too early */
191 ref_get(&job->refcount);
192
193 listener->done = semaphore_create(0);
194
195 charon->bus->add_logger(charon->bus, &listener->logger.public);
196 charon->bus->add_listener(charon->bus, &listener->public);
197 lib->processor->queue_job(lib->processor, &job->public);
198
199 thread_cleanup_push((thread_cleanup_t)listener_unregister, listener);
200 old = thread_cancelability(TRUE);
201 if (timeout)
202 {
203 timed_out = listener->done->timed_wait(listener->done, timeout);
204 }
205 else
206 {
207 listener->done->wait(listener->done);
208 }
209 thread_cancelability(old);
210 thread_cleanup_pop(TRUE);
211 return timed_out;
212 }
213
214 METHOD(logger_t, listener_log, void,
215 interface_logger_t *this, debug_t group, level_t level, int thread,
216 ike_sa_t *ike_sa, const char *message)
217 {
218 ike_sa_t *target;
219
220 this->listener->lock->lock(this->listener->lock);
221 target = this->listener->ike_sa;
222 this->listener->lock->unlock(this->listener->lock);
223
224 if (target == ike_sa)
225 {
226 if (!this->callback(this->param, group, level, ike_sa, message))
227 {
228 this->listener->status = NEED_MORE;
229 listener_done(this->listener);
230 }
231 }
232 }
233
234 METHOD(logger_t, listener_get_level, level_t,
235 interface_logger_t *this, debug_t group)
236 {
237 /* in order to allow callback listeners to decide what they want to log
238 * we request any log message, but only if we actually want logging */
239 return this->callback == controller_cb_empty ? LEVEL_SILENT : LEVEL_PRIVATE;
240 }
241
242 METHOD(job_t, get_priority_medium, job_priority_t,
243 job_t *this)
244 {
245 return JOB_PRIO_MEDIUM;
246 }
247
248 METHOD(listener_t, ike_state_change, bool,
249 interface_listener_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
250 {
251 ike_sa_t *target;
252
253 this->lock->lock(this->lock);
254 target = this->ike_sa;
255 this->lock->unlock(this->lock);
256
257 if (target == ike_sa)
258 {
259 switch (state)
260 {
261 #ifdef ME
262 case IKE_ESTABLISHED:
263 { /* mediation connections are complete without CHILD_SA */
264 peer_cfg_t *peer_cfg = ike_sa->get_peer_cfg(ike_sa);
265
266 if (peer_cfg->is_mediation(peer_cfg))
267 {
268 this->status = SUCCESS;
269 return listener_done(this);
270 }
271 break;
272 }
273 #endif /* ME */
274 case IKE_DESTROYING:
275 if (ike_sa->get_state(ike_sa) == IKE_DELETING)
276 { /* proper termination */
277 this->status = SUCCESS;
278 }
279 return listener_done(this);
280 default:
281 break;
282 }
283 }
284 return TRUE;
285 }
286
287 METHOD(listener_t, child_state_change, bool,
288 interface_listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
289 child_sa_state_t state)
290 {
291 ike_sa_t *target;
292
293 this->lock->lock(this->lock);
294 target = this->ike_sa;
295 this->lock->unlock(this->lock);
296
297 if (target == ike_sa)
298 {
299 switch (state)
300 {
301 case CHILD_INSTALLED:
302 this->status = SUCCESS;
303 return listener_done(this);
304 case CHILD_DESTROYING:
305 switch (child_sa->get_state(child_sa))
306 {
307 case CHILD_DELETING:
308 /* proper delete */
309 this->status = SUCCESS;
310 break;
311 case CHILD_RETRYING:
312 /* retrying with a different DH group; survive another
313 * initiation round */
314 this->status = NEED_MORE;
315 return TRUE;
316 case CHILD_CREATED:
317 if (this->status == NEED_MORE)
318 {
319 this->status = FAILED;
320 return TRUE;
321 }
322 break;
323 default:
324 break;
325 }
326 return listener_done(this);
327 default:
328 break;
329 }
330 }
331 return TRUE;
332 }
333
334 METHOD(job_t, destroy_job, void,
335 interface_job_t *this)
336 {
337 if (ref_put(&this->refcount))
338 {
339 this->listener.lock->destroy(this->listener.lock);
340 DESTROY_IF(this->listener.done);
341 free(this);
342 }
343 }
344
345 METHOD(controller_t, create_ike_sa_enumerator, enumerator_t*,
346 private_controller_t *this, bool wait)
347 {
348 return charon->ike_sa_manager->create_enumerator(charon->ike_sa_manager,
349 wait);
350 }
351
352 METHOD(job_t, initiate_execute, job_requeue_t,
353 interface_job_t *job)
354 {
355 ike_sa_t *ike_sa;
356 interface_listener_t *listener = &job->listener;
357 peer_cfg_t *peer_cfg = listener->peer_cfg;
358
359 ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
360 peer_cfg);
361 if (!ike_sa)
362 {
363 listener->child_cfg->destroy(listener->child_cfg);
364 peer_cfg->destroy(peer_cfg);
365 listener->status = FAILED;
366 listener_done(listener);
367 return JOB_REQUEUE_NONE;
368 }
369 listener->lock->lock(listener->lock);
370 listener->ike_sa = ike_sa;
371 listener->lock->unlock(listener->lock);
372
373 if (ike_sa->get_peer_cfg(ike_sa) == NULL)
374 {
375 ike_sa->set_peer_cfg(ike_sa, peer_cfg);
376 }
377 peer_cfg->destroy(peer_cfg);
378
379 if (listener->limits && ike_sa->get_state(ike_sa) == IKE_CREATED)
380 { /* only check if we are not reusing an IKE_SA */
381 u_int half_open, limit_half_open, limit_job_load;
382
383 half_open = charon->ike_sa_manager->get_half_open_count(
384 charon->ike_sa_manager, NULL, FALSE);
385 limit_half_open = lib->settings->get_int(lib->settings,
386 "%s.init_limit_half_open", 0, lib->ns);
387 limit_job_load = lib->settings->get_int(lib->settings,
388 "%s.init_limit_job_load", 0, lib->ns);
389 if (limit_half_open && half_open >= limit_half_open)
390 {
391 DBG1(DBG_IKE, "abort IKE_SA initiation, half open IKE_SA count of "
392 "%d exceeds limit of %d", half_open, limit_half_open);
393 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
394 ike_sa);
395 listener->child_cfg->destroy(listener->child_cfg);
396 listener->status = INVALID_STATE;
397 listener_done(listener);
398 return JOB_REQUEUE_NONE;
399 }
400 if (limit_job_load)
401 {
402 u_int jobs = 0, i;
403
404 for (i = 0; i < JOB_PRIO_MAX; i++)
405 {
406 jobs += lib->processor->get_job_load(lib->processor, i);
407 }
408 if (jobs > limit_job_load)
409 {
410 DBG1(DBG_IKE, "abort IKE_SA initiation, job load of %d exceeds "
411 "limit of %d", jobs, limit_job_load);
412 charon->ike_sa_manager->checkin_and_destroy(
413 charon->ike_sa_manager, ike_sa);
414 listener->child_cfg->destroy(listener->child_cfg);
415 listener->status = INVALID_STATE;
416 listener_done(listener);
417 return JOB_REQUEUE_NONE;
418 }
419 }
420 }
421
422 if (ike_sa->initiate(ike_sa, listener->child_cfg, 0, NULL, NULL) == SUCCESS)
423 {
424 if (!listener->logger.callback)
425 {
426 listener->status = SUCCESS;
427 }
428 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
429 }
430 else
431 {
432 listener->status = FAILED;
433 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
434 ike_sa);
435 }
436 return JOB_REQUEUE_NONE;
437 }
438
439 METHOD(controller_t, initiate, status_t,
440 private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
441 controller_cb_t callback, void *param, u_int timeout, bool limits)
442 {
443 interface_job_t *job;
444 status_t status;
445
446 INIT(job,
447 .listener = {
448 .public = {
449 .ike_state_change = _ike_state_change,
450 .child_state_change = _child_state_change,
451 },
452 .logger = {
453 .public = {
454 .log = _listener_log,
455 .get_level = _listener_get_level,
456 },
457 .callback = callback,
458 .param = param,
459 },
460 .status = FAILED,
461 .child_cfg = child_cfg,
462 .peer_cfg = peer_cfg,
463 .lock = spinlock_create(),
464 .limits = limits,
465 },
466 .public = {
467 .execute = _initiate_execute,
468 .get_priority = _get_priority_medium,
469 .destroy = _destroy_job,
470 },
471 .refcount = 1,
472 );
473 job->listener.logger.listener = &job->listener;
474 thread_cleanup_push((void*)destroy_job, job);
475
476 if (callback == NULL)
477 {
478 initiate_execute(job);
479 }
480 else
481 {
482 if (wait_for_listener(job, timeout))
483 {
484 job->listener.status = OUT_OF_RES;
485 }
486 }
487 status = job->listener.status;
488 thread_cleanup_pop(TRUE);
489 return status;
490 }
491
492 METHOD(job_t, terminate_ike_execute, job_requeue_t,
493 interface_job_t *job)
494 {
495 interface_listener_t *listener = &job->listener;
496 uint32_t unique_id = listener->id;
497 ike_sa_t *ike_sa;
498
499 ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
500 unique_id);
501 if (!ike_sa)
502 {
503 DBG1(DBG_IKE, "unable to terminate IKE_SA: ID %d not found", unique_id);
504 listener->status = NOT_FOUND;
505 /* release listener */
506 listener_done(listener);
507 return JOB_REQUEUE_NONE;
508 }
509 listener->lock->lock(listener->lock);
510 listener->ike_sa = ike_sa;
511 listener->lock->unlock(listener->lock);
512
513 if (ike_sa->delete(ike_sa) != DESTROY_ME)
514 { /* delete failed */
515 listener->status = FAILED;
516 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
517 }
518 else
519 {
520 if (!listener->logger.callback)
521 {
522 listener->status = SUCCESS;
523 }
524 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
525 ike_sa);
526 }
527 return JOB_REQUEUE_NONE;
528 }
529
530 METHOD(controller_t, terminate_ike, status_t,
531 controller_t *this, uint32_t unique_id,
532 controller_cb_t callback, void *param, u_int timeout)
533 {
534 interface_job_t *job;
535 status_t status;
536
537 INIT(job,
538 .listener = {
539 .public = {
540 .ike_state_change = _ike_state_change,
541 .child_state_change = _child_state_change,
542 },
543 .logger = {
544 .public = {
545 .log = _listener_log,
546 .get_level = _listener_get_level,
547 },
548 .callback = callback,
549 .param = param,
550 },
551 .status = FAILED,
552 .id = unique_id,
553 .lock = spinlock_create(),
554 },
555 .public = {
556 .execute = _terminate_ike_execute,
557 .get_priority = _get_priority_medium,
558 .destroy = _destroy_job,
559 },
560 .refcount = 1,
561 );
562 job->listener.logger.listener = &job->listener;
563 thread_cleanup_push((void*)destroy_job, job);
564
565 if (callback == NULL)
566 {
567 terminate_ike_execute(job);
568 }
569 else
570 {
571 if (wait_for_listener(job, timeout))
572 {
573 job->listener.status = OUT_OF_RES;
574 }
575 }
576 status = job->listener.status;
577 thread_cleanup_pop(TRUE);
578 return status;
579 }
580
581 METHOD(job_t, terminate_child_execute, job_requeue_t,
582 interface_job_t *job)
583 {
584 interface_listener_t *listener = &job->listener;
585 uint32_t id = listener->id;
586 child_sa_t *child_sa;
587 ike_sa_t *ike_sa;
588
589 ike_sa = charon->child_sa_manager->checkout_by_id(charon->child_sa_manager,
590 id, &child_sa);
591 if (!ike_sa)
592 {
593 DBG1(DBG_IKE, "unable to terminate, CHILD_SA with ID %d not found", id);
594 listener->status = NOT_FOUND;
595 /* release listener */
596 listener_done(listener);
597 return JOB_REQUEUE_NONE;
598 }
599 listener->lock->lock(listener->lock);
600 listener->ike_sa = ike_sa;
601 listener->lock->unlock(listener->lock);
602
603 if (child_sa->get_state(child_sa) == CHILD_ROUTED)
604 {
605 DBG1(DBG_IKE, "unable to terminate, established "
606 "CHILD_SA with ID %d not found", id);
607 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
608 listener->status = NOT_FOUND;
609 /* release listener */
610 listener_done(listener);
611 return JOB_REQUEUE_NONE;
612 }
613
614 if (ike_sa->delete_child_sa(ike_sa, child_sa->get_protocol(child_sa),
615 child_sa->get_spi(child_sa, TRUE), FALSE) != DESTROY_ME)
616 {
617 if (!listener->logger.callback)
618 {
619 listener->status = SUCCESS;
620 }
621 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
622 }
623 else
624 {
625 listener->status = FAILED;
626 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
627 ike_sa);
628 }
629 return JOB_REQUEUE_NONE;
630 }
631
632 METHOD(controller_t, terminate_child, status_t,
633 controller_t *this, uint32_t unique_id,
634 controller_cb_t callback, void *param, u_int timeout)
635 {
636 interface_job_t *job;
637 status_t status;
638
639 INIT(job,
640 .listener = {
641 .public = {
642 .ike_state_change = _ike_state_change,
643 .child_state_change = _child_state_change,
644 },
645 .logger = {
646 .public = {
647 .log = _listener_log,
648 .get_level = _listener_get_level,
649 },
650 .callback = callback,
651 .param = param,
652 },
653 .status = FAILED,
654 .id = unique_id,
655 .lock = spinlock_create(),
656 },
657 .public = {
658 .execute = _terminate_child_execute,
659 .get_priority = _get_priority_medium,
660 .destroy = _destroy_job,
661 },
662 .refcount = 1,
663 );
664 job->listener.logger.listener = &job->listener;
665 thread_cleanup_push((void*)destroy_job, job);
666
667 if (callback == NULL)
668 {
669 terminate_child_execute(job);
670 }
671 else
672 {
673 if (wait_for_listener(job, timeout))
674 {
675 job->listener.status = OUT_OF_RES;
676 }
677 }
678 status = job->listener.status;
679 thread_cleanup_pop(TRUE);
680 return status;
681 }
682
683 /**
684 * See header
685 */
686 bool controller_cb_empty(void *param, debug_t group, level_t level,
687 ike_sa_t *ike_sa, const char *message)
688 {
689 return TRUE;
690 }
691
692 METHOD(controller_t, destroy, void,
693 private_controller_t *this)
694 {
695 free(this);
696 }
697
698 /*
699 * Described in header-file
700 */
701 controller_t *controller_create(void)
702 {
703 private_controller_t *this;
704
705 INIT(this,
706 .public = {
707 .create_ike_sa_enumerator = _create_ike_sa_enumerator,
708 .initiate = _initiate,
709 .terminate_ike = _terminate_ike,
710 .terminate_child = _terminate_child,
711 .destroy = _destroy,
712 },
713 );
714
715 return &this->public;
716 }