proposal-substructure: Fix incorrect type for IKEv2 proposals
[strongswan.git] / src / libcharon / control / controller.c
1 /*
2 * Copyright (C) 2011-2015 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Copyright (C) 2011 revosec AG
5 * HSR Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include "controller.h"
19
20 #include <sys/types.h>
21 #include <dirent.h>
22 #include <sys/stat.h>
23
24 #include <daemon.h>
25 #include <library.h>
26 #include <threading/thread.h>
27 #include <threading/spinlock.h>
28 #include <threading/semaphore.h>
29
30 typedef struct private_controller_t private_controller_t;
31 typedef struct interface_listener_t interface_listener_t;
32 typedef struct interface_logger_t interface_logger_t;
33
34 /**
35 * Private data of an stroke_t object.
36 */
37 struct private_controller_t {
38
39 /**
40 * Public part of stroke_t object.
41 */
42 controller_t public;
43 };
44
45 /**
46 * helper struct for the logger interface
47 */
48 struct interface_logger_t {
49 /**
50 * public logger interface
51 */
52 logger_t public;
53
54 /**
55 * reference to the listener
56 */
57 interface_listener_t *listener;
58
59 /**
60 * interface callback (listener gets redirected to here)
61 */
62 controller_cb_t callback;
63
64 /**
65 * user parameter to pass to callback
66 */
67 void *param;
68 };
69
70 /**
71 * helper struct to map listener callbacks to interface callbacks
72 */
73 struct interface_listener_t {
74
75 /**
76 * public bus listener interface
77 */
78 listener_t public;
79
80 /**
81 * logger interface
82 */
83 interface_logger_t logger;
84
85 /**
86 * status of the operation, return to method callers
87 */
88 status_t status;
89
90 /**
91 * child configuration, used for initiate
92 */
93 child_cfg_t *child_cfg;
94
95 /**
96 * peer configuration, used for initiate
97 */
98 peer_cfg_t *peer_cfg;
99
100 /**
101 * IKE_SA to handle
102 */
103 ike_sa_t *ike_sa;
104
105 /**
106 * unique ID, used for various methods
107 */
108 uint32_t id;
109
110 /**
111 * semaphore to implement wait_for_listener()
112 */
113 semaphore_t *done;
114
115 /**
116 * spinlock to update the IKE_SA handle properly
117 */
118 spinlock_t *lock;
119
120 union {
121 /**
122 * whether to check limits during initiation
123 */
124 bool limits;
125
126 /**
127 * whether to force termination
128 */
129 bool force;
130 } options;
131 };
132
133
134 typedef struct interface_job_t interface_job_t;
135
136 /**
137 * job for asynchronous listen operations
138 */
139 struct interface_job_t {
140
141 /**
142 * job interface
143 */
144 job_t public;
145
146 /**
147 * associated listener
148 */
149 interface_listener_t listener;
150
151 /**
152 * the job is reference counted as the thread executing a job as well as
153 * the thread waiting in wait_for_listener() require it but either of them
154 * could be done first
155 */
156 refcount_t refcount;
157 };
158
159 /**
160 * This function wakes a thread that is waiting in wait_for_listener(),
161 * either from a listener or from a job.
162 */
163 static inline bool listener_done(interface_listener_t *listener)
164 {
165 if (listener->done)
166 {
167 listener->done->post(listener->done);
168 }
169 return FALSE;
170 }
171
172 /**
173 * thread_cleanup_t handler to unregister a listener.
174 */
175 static void listener_unregister(interface_listener_t *listener)
176 {
177 charon->bus->remove_listener(charon->bus, &listener->public);
178 charon->bus->remove_logger(charon->bus, &listener->logger.public);
179 }
180
181 /**
182 * Registers the listener, executes the job and then waits synchronously until
183 * the listener is done or the timeout occurred.
184 *
185 * @note Use 'return listener_done(listener)' to properly unregister a listener
186 *
187 * @param listener listener to register
188 * @param job job to execute asynchronously when registered, or NULL
189 * @param timeout max timeout in ms to listen for events, 0 to disable
190 * @return TRUE if timed out
191 */
192 static bool wait_for_listener(interface_job_t *job, u_int timeout)
193 {
194 interface_listener_t *listener = &job->listener;
195 bool old, timed_out = FALSE;
196
197 /* avoid that the job is destroyed too early */
198 ref_get(&job->refcount);
199
200 listener->done = semaphore_create(0);
201
202 charon->bus->add_logger(charon->bus, &listener->logger.public);
203 charon->bus->add_listener(charon->bus, &listener->public);
204 lib->processor->queue_job(lib->processor, &job->public);
205
206 thread_cleanup_push((thread_cleanup_t)listener_unregister, listener);
207 old = thread_cancelability(TRUE);
208 if (timeout)
209 {
210 timed_out = listener->done->timed_wait(listener->done, timeout);
211 }
212 else
213 {
214 listener->done->wait(listener->done);
215 }
216 thread_cancelability(old);
217 thread_cleanup_pop(TRUE);
218 return timed_out;
219 }
220
221 METHOD(logger_t, listener_log, void,
222 interface_logger_t *this, debug_t group, level_t level, int thread,
223 ike_sa_t *ike_sa, const char *message)
224 {
225 ike_sa_t *target;
226
227 this->listener->lock->lock(this->listener->lock);
228 target = this->listener->ike_sa;
229 this->listener->lock->unlock(this->listener->lock);
230
231 if (target == ike_sa)
232 {
233 if (!this->callback(this->param, group, level, ike_sa, message))
234 {
235 this->listener->status = NEED_MORE;
236 listener_done(this->listener);
237 }
238 }
239 }
240
241 METHOD(logger_t, listener_get_level, level_t,
242 interface_logger_t *this, debug_t group)
243 {
244 /* in order to allow callback listeners to decide what they want to log
245 * we request any log message, but only if we actually want logging */
246 return this->callback == controller_cb_empty ? LEVEL_SILENT : LEVEL_PRIVATE;
247 }
248
249 METHOD(job_t, get_priority_medium, job_priority_t,
250 job_t *this)
251 {
252 return JOB_PRIO_MEDIUM;
253 }
254
255 METHOD(listener_t, ike_state_change, bool,
256 interface_listener_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
257 {
258 ike_sa_t *target;
259
260 this->lock->lock(this->lock);
261 target = this->ike_sa;
262 this->lock->unlock(this->lock);
263
264 if (target == ike_sa)
265 {
266 switch (state)
267 {
268 #ifdef ME
269 case IKE_ESTABLISHED:
270 { /* mediation connections are complete without CHILD_SA */
271 peer_cfg_t *peer_cfg = ike_sa->get_peer_cfg(ike_sa);
272
273 if (peer_cfg->is_mediation(peer_cfg))
274 {
275 this->status = SUCCESS;
276 return listener_done(this);
277 }
278 break;
279 }
280 #endif /* ME */
281 case IKE_DESTROYING:
282 return listener_done(this);
283 default:
284 break;
285 }
286 }
287 return TRUE;
288 }
289
290 METHOD(listener_t, ike_state_change_terminate, bool,
291 interface_listener_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
292 {
293 ike_sa_t *target;
294
295 this->lock->lock(this->lock);
296 target = this->ike_sa;
297 this->lock->unlock(this->lock);
298
299 if (target == ike_sa)
300 {
301 switch (state)
302 {
303 case IKE_DESTROYING:
304 this->status = SUCCESS;
305 return listener_done(this);
306 default:
307 break;
308 }
309 }
310 return TRUE;
311 }
312
313 METHOD(listener_t, child_state_change, bool,
314 interface_listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
315 child_sa_state_t state)
316 {
317 ike_sa_t *target;
318
319 this->lock->lock(this->lock);
320 target = this->ike_sa;
321 this->lock->unlock(this->lock);
322
323 if (target == ike_sa)
324 {
325 switch (state)
326 {
327 case CHILD_INSTALLED:
328 this->status = SUCCESS;
329 return listener_done(this);
330 case CHILD_DESTROYING:
331 switch (child_sa->get_state(child_sa))
332 {
333 case CHILD_RETRYING:
334 /* retrying with a different DH group; survive another
335 * initiation round */
336 this->status = NEED_MORE;
337 return TRUE;
338 case CHILD_CREATED:
339 if (this->status == NEED_MORE)
340 {
341 this->status = FAILED;
342 return TRUE;
343 }
344 break;
345 default:
346 break;
347 }
348 return listener_done(this);
349 default:
350 break;
351 }
352 }
353 return TRUE;
354 }
355
356 METHOD(listener_t, child_state_change_terminate, bool,
357 interface_listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
358 child_sa_state_t state)
359 {
360 ike_sa_t *target;
361
362 this->lock->lock(this->lock);
363 target = this->ike_sa;
364 this->lock->unlock(this->lock);
365
366 if (target == ike_sa)
367 {
368 switch (state)
369 {
370 case CHILD_DESTROYING:
371 switch (child_sa->get_state(child_sa))
372 {
373 case CHILD_DELETED:
374 /* proper delete */
375 this->status = SUCCESS;
376 break;
377 default:
378 break;
379 }
380 return listener_done(this);
381 default:
382 break;
383 }
384 }
385 return TRUE;
386 }
387
388 METHOD(job_t, destroy_job, void,
389 interface_job_t *this)
390 {
391 if (ref_put(&this->refcount))
392 {
393 this->listener.lock->destroy(this->listener.lock);
394 DESTROY_IF(this->listener.done);
395 free(this);
396 }
397 }
398
399 METHOD(controller_t, create_ike_sa_enumerator, enumerator_t*,
400 private_controller_t *this, bool wait)
401 {
402 return charon->ike_sa_manager->create_enumerator(charon->ike_sa_manager,
403 wait);
404 }
405
406 METHOD(job_t, initiate_execute, job_requeue_t,
407 interface_job_t *job)
408 {
409 ike_sa_t *ike_sa;
410 interface_listener_t *listener = &job->listener;
411 peer_cfg_t *peer_cfg = listener->peer_cfg;
412
413 ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
414 peer_cfg);
415 if (!ike_sa)
416 {
417 listener->child_cfg->destroy(listener->child_cfg);
418 peer_cfg->destroy(peer_cfg);
419 listener->status = FAILED;
420 listener_done(listener);
421 return JOB_REQUEUE_NONE;
422 }
423 listener->lock->lock(listener->lock);
424 listener->ike_sa = ike_sa;
425 listener->lock->unlock(listener->lock);
426
427 if (ike_sa->get_peer_cfg(ike_sa) == NULL)
428 {
429 ike_sa->set_peer_cfg(ike_sa, peer_cfg);
430 }
431 peer_cfg->destroy(peer_cfg);
432
433 if (listener->options.limits && ike_sa->get_state(ike_sa) == IKE_CREATED)
434 { /* only check if we are not reusing an IKE_SA */
435 u_int half_open, limit_half_open, limit_job_load;
436
437 half_open = charon->ike_sa_manager->get_half_open_count(
438 charon->ike_sa_manager, NULL, FALSE);
439 limit_half_open = lib->settings->get_int(lib->settings,
440 "%s.init_limit_half_open", 0, lib->ns);
441 limit_job_load = lib->settings->get_int(lib->settings,
442 "%s.init_limit_job_load", 0, lib->ns);
443 if (limit_half_open && half_open >= limit_half_open)
444 {
445 DBG1(DBG_IKE, "abort IKE_SA initiation, half open IKE_SA count of "
446 "%d exceeds limit of %d", half_open, limit_half_open);
447 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
448 ike_sa);
449 listener->child_cfg->destroy(listener->child_cfg);
450 listener->status = INVALID_STATE;
451 listener_done(listener);
452 return JOB_REQUEUE_NONE;
453 }
454 if (limit_job_load)
455 {
456 u_int jobs = 0, i;
457
458 for (i = 0; i < JOB_PRIO_MAX; i++)
459 {
460 jobs += lib->processor->get_job_load(lib->processor, i);
461 }
462 if (jobs > limit_job_load)
463 {
464 DBG1(DBG_IKE, "abort IKE_SA initiation, job load of %d exceeds "
465 "limit of %d", jobs, limit_job_load);
466 charon->ike_sa_manager->checkin_and_destroy(
467 charon->ike_sa_manager, ike_sa);
468 listener->child_cfg->destroy(listener->child_cfg);
469 listener->status = INVALID_STATE;
470 listener_done(listener);
471 return JOB_REQUEUE_NONE;
472 }
473 }
474 }
475
476 if (ike_sa->initiate(ike_sa, listener->child_cfg, 0, NULL, NULL) == SUCCESS)
477 {
478 if (!listener->logger.callback)
479 {
480 listener->status = SUCCESS;
481 }
482 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
483 }
484 else
485 {
486 listener->status = FAILED;
487 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
488 ike_sa);
489 }
490 return JOB_REQUEUE_NONE;
491 }
492
493 METHOD(controller_t, initiate, status_t,
494 private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
495 controller_cb_t callback, void *param, u_int timeout, bool limits)
496 {
497 interface_job_t *job;
498 status_t status;
499
500 INIT(job,
501 .listener = {
502 .public = {
503 .ike_state_change = _ike_state_change,
504 .child_state_change = _child_state_change,
505 },
506 .logger = {
507 .public = {
508 .log = _listener_log,
509 .get_level = _listener_get_level,
510 },
511 .callback = callback,
512 .param = param,
513 },
514 .status = FAILED,
515 .child_cfg = child_cfg,
516 .peer_cfg = peer_cfg,
517 .lock = spinlock_create(),
518 .options.limits = limits,
519 },
520 .public = {
521 .execute = _initiate_execute,
522 .get_priority = _get_priority_medium,
523 .destroy = _destroy_job,
524 },
525 .refcount = 1,
526 );
527 job->listener.logger.listener = &job->listener;
528 thread_cleanup_push((void*)destroy_job, job);
529
530 if (callback == NULL)
531 {
532 initiate_execute(job);
533 }
534 else
535 {
536 if (wait_for_listener(job, timeout))
537 {
538 job->listener.status = OUT_OF_RES;
539 }
540 }
541 status = job->listener.status;
542 thread_cleanup_pop(TRUE);
543 return status;
544 }
545
546 METHOD(job_t, terminate_ike_execute, job_requeue_t,
547 interface_job_t *job)
548 {
549 interface_listener_t *listener = &job->listener;
550 uint32_t unique_id = listener->id;
551 ike_sa_t *ike_sa;
552
553 ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
554 unique_id);
555 if (!ike_sa)
556 {
557 DBG1(DBG_IKE, "unable to terminate IKE_SA: ID %d not found", unique_id);
558 listener->status = NOT_FOUND;
559 /* release listener */
560 listener_done(listener);
561 return JOB_REQUEUE_NONE;
562 }
563 listener->lock->lock(listener->lock);
564 listener->ike_sa = ike_sa;
565 listener->lock->unlock(listener->lock);
566
567 if (ike_sa->delete(ike_sa, listener->options.force) != DESTROY_ME)
568 { /* delete queued */
569 listener->status = FAILED;
570 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
571 }
572 else
573 {
574 if (!listener->logger.callback)
575 {
576 listener->status = SUCCESS;
577 }
578 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
579 ike_sa);
580 }
581 return JOB_REQUEUE_NONE;
582 }
583
584 METHOD(controller_t, terminate_ike, status_t,
585 controller_t *this, uint32_t unique_id, bool force,
586 controller_cb_t callback, void *param, u_int timeout)
587 {
588 interface_job_t *job;
589 status_t status;
590
591 INIT(job,
592 .listener = {
593 .public = {
594 .ike_state_change = _ike_state_change_terminate,
595 },
596 .logger = {
597 .public = {
598 .log = _listener_log,
599 .get_level = _listener_get_level,
600 },
601 .callback = callback,
602 .param = param,
603 },
604 .status = FAILED,
605 .id = unique_id,
606 .lock = spinlock_create(),
607 },
608 .public = {
609 .execute = _terminate_ike_execute,
610 .get_priority = _get_priority_medium,
611 .destroy = _destroy_job,
612 },
613 .refcount = 1,
614 );
615 job->listener.logger.listener = &job->listener;
616 thread_cleanup_push((void*)destroy_job, job);
617
618 if (callback == NULL)
619 {
620 job->listener.options.force = force;
621 terminate_ike_execute(job);
622 }
623 else
624 {
625 if (!timeout)
626 {
627 job->listener.options.force = force;
628 }
629 if (wait_for_listener(job, timeout))
630 {
631 job->listener.status = OUT_OF_RES;
632
633 if (force)
634 { /* force termination once timeout is reached */
635 job->listener.options.force = TRUE;
636 terminate_ike_execute(job);
637 }
638 }
639 }
640 status = job->listener.status;
641 thread_cleanup_pop(TRUE);
642 return status;
643 }
644
645 METHOD(job_t, terminate_child_execute, job_requeue_t,
646 interface_job_t *job)
647 {
648 interface_listener_t *listener = &job->listener;
649 uint32_t id = listener->id;
650 child_sa_t *child_sa;
651 ike_sa_t *ike_sa;
652
653 ike_sa = charon->child_sa_manager->checkout_by_id(charon->child_sa_manager,
654 id, &child_sa);
655 if (!ike_sa)
656 {
657 DBG1(DBG_IKE, "unable to terminate, CHILD_SA with ID %d not found", id);
658 listener->status = NOT_FOUND;
659 /* release listener */
660 listener_done(listener);
661 return JOB_REQUEUE_NONE;
662 }
663 listener->lock->lock(listener->lock);
664 listener->ike_sa = ike_sa;
665 listener->lock->unlock(listener->lock);
666
667 if (ike_sa->delete_child_sa(ike_sa, child_sa->get_protocol(child_sa),
668 child_sa->get_spi(child_sa, TRUE), FALSE) != DESTROY_ME)
669 {
670 if (!listener->logger.callback)
671 {
672 listener->status = SUCCESS;
673 }
674 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
675 }
676 else
677 {
678 listener->status = FAILED;
679 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
680 ike_sa);
681 }
682 return JOB_REQUEUE_NONE;
683 }
684
685 METHOD(controller_t, terminate_child, status_t,
686 controller_t *this, uint32_t unique_id,
687 controller_cb_t callback, void *param, u_int timeout)
688 {
689 interface_job_t *job;
690 status_t status;
691
692 INIT(job,
693 .listener = {
694 .public = {
695 .ike_state_change = _ike_state_change_terminate,
696 .child_state_change = _child_state_change_terminate,
697 },
698 .logger = {
699 .public = {
700 .log = _listener_log,
701 .get_level = _listener_get_level,
702 },
703 .callback = callback,
704 .param = param,
705 },
706 .status = FAILED,
707 .id = unique_id,
708 .lock = spinlock_create(),
709 },
710 .public = {
711 .execute = _terminate_child_execute,
712 .get_priority = _get_priority_medium,
713 .destroy = _destroy_job,
714 },
715 .refcount = 1,
716 );
717 job->listener.logger.listener = &job->listener;
718 thread_cleanup_push((void*)destroy_job, job);
719
720 if (callback == NULL)
721 {
722 terminate_child_execute(job);
723 }
724 else
725 {
726 if (wait_for_listener(job, timeout))
727 {
728 job->listener.status = OUT_OF_RES;
729 }
730 }
731 status = job->listener.status;
732 thread_cleanup_pop(TRUE);
733 return status;
734 }
735
736 /**
737 * See header
738 */
739 bool controller_cb_empty(void *param, debug_t group, level_t level,
740 ike_sa_t *ike_sa, const char *message)
741 {
742 return TRUE;
743 }
744
745 METHOD(controller_t, destroy, void,
746 private_controller_t *this)
747 {
748 free(this);
749 }
750
751 /*
752 * Described in header-file
753 */
754 controller_t *controller_create(void)
755 {
756 private_controller_t *this;
757
758 INIT(this,
759 .public = {
760 .create_ike_sa_enumerator = _create_ike_sa_enumerator,
761 .initiate = _initiate,
762 .terminate_ike = _terminate_ike,
763 .terminate_child = _terminate_child,
764 .destroy = _destroy,
765 },
766 );
767
768 return &this->public;
769 }