src/charon/sa/ike_sa_manager.c

   1 /**
   2  * @file ike_sa_manager.c
   3  *
   4  * @brief Implementation of ike_sa_mananger_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005-2006 Martin Willi
  10  * Copyright (C) 2005 Jan Hutter
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include <pthread.h>
  25 #include <string.h>
  26
  27 #include "ike_sa_manager.h"
  28
  29 #include <daemon.h>
  30 #include <sa/ike_sa_id.h>
  31 #include <bus/bus.h>
  32 #include <utils/linked_list.h>
  33
  34 typedef struct entry_t entry_t;
  35
  36 /**
  37  * An entry in the linked list, contains IKE_SA, locking and lookup data.
  38  */
  39 struct entry_t {
  40
  41         /**
  42          * Number of threads waiting for this ike_sa_t object.
  43          */
  44         int waiting_threads;
  45
  46         /**
  47          * Condvar where threads can wait until ike_sa_t object is free for use again.
  48          */
  49         pthread_cond_t condvar;
  50
  51         /**
  52          * Is this ike_sa currently checked out?
  53          */
  54         bool checked_out;
  55
  56         /**
  57          * Does this SA drives out new threads?
  58          */
  59         bool driveout_new_threads;
  60
  61         /**
  62          * Does this SA drives out waiting threads?
  63          */
  64         bool driveout_waiting_threads;
  65
  66         /**
  67          * Identifiaction of an IKE_SA (SPIs).
  68          */
  69         ike_sa_id_t *ike_sa_id;
  70
  71         /**
  72          * The contained ike_sa_t object.
  73          */
  74         ike_sa_t *ike_sa;
  75
  76         /**
  77          * hash of the IKE_SA_INIT message, used to detect retransmissions
  78          */
  79         chunk_t init_hash;
  80
  81         /**
  82          * message ID currently processing, if any
  83          */
  84         u_int32_t message_id;
  85 };
  86
  87 /**
  88  * Implementation of entry_t.destroy.
  89  */
  90 static status_t entry_destroy(entry_t *this)
  91 {
  92         /* also destroy IKE SA */
  93         this->ike_sa->destroy(this->ike_sa);
  94         this->ike_sa_id->destroy(this->ike_sa_id);
  95         chunk_free(&this->init_hash);
  96         free(this);
  97         return SUCCESS;
  98 }
  99
 100 /**
 101  * Creates a new entry for the ike_sa_t list.
 102  */
 103 static entry_t *entry_create(ike_sa_id_t *ike_sa_id)
 104 {
 105         entry_t *this = malloc_thing(entry_t);
 106
 107         this->waiting_threads = 0;
 108         pthread_cond_init(&this->condvar, NULL);
 109
 110         /* we set checkout flag when we really give it out */
 111         this->checked_out = FALSE;
 112         this->driveout_new_threads = FALSE;
 113         this->driveout_waiting_threads = FALSE;
 114         this->message_id = -1;
 115         this->init_hash = chunk_empty;
 116
 117         /* ike_sa_id is always cloned */
 118         this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
 119
 120         /* create new ike_sa */
 121         this->ike_sa = ike_sa_create(ike_sa_id);
 122
 123         return this;
 124 }
 125
 126
 127 typedef struct private_ike_sa_manager_t private_ike_sa_manager_t;
 128
 129 /**
 130  * Additional private members of ike_sa_manager_t.
 131  */
 132 struct private_ike_sa_manager_t {
 133         /**
 134          * Public interface of ike_sa_manager_t.
 135          */
 136          ike_sa_manager_t public;
 137
 138          /**
 139           * Lock for exclusivly accessing the manager.
 140           */
 141          pthread_mutex_t mutex;
 142
 143          /**
 144           * Linked list with entries for the ike_sa_t objects.
 145           */
 146          linked_list_t *ike_sa_list;
 147
 148          /**
 149           * A randomizer, to get random SPIs for our side
 150           */
 151          randomizer_t *randomizer;
 152
 153          /**
 154           * SHA1 hasher for IKE_SA_INIT retransmit detection
 155           */
 156          hasher_t *hasher;
 157 };
 158
 159 /**
 160  * Implementation of private_ike_sa_manager_t.get_entry_by_id.
 161  */
 162 static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, entry_t **entry)
 163 {
 164         linked_list_t *list = this->ike_sa_list;
 165         iterator_t *iterator;
 166         entry_t *current;
 167         status_t status;
 168
 169         /* create iterator over list of ike_sa's */
 170         iterator = list->create_iterator(list, TRUE);
 171
 172         /* default status */
 173         status = NOT_FOUND;
 174
 175         while (iterator->iterate(iterator, (void**)&current))
 176         {
 177                 if (current->ike_sa_id->equals(current->ike_sa_id, ike_sa_id))
 178                 {
 179                         DBG2(DBG_MGR,  "found entry by both SPIs");
 180                         *entry = current;
 181                         status = SUCCESS;
 182                         break;
 183                 }
 184                 if (ike_sa_id->get_responder_spi(ike_sa_id) == 0 ||
 185                         current->ike_sa_id->get_responder_spi(current->ike_sa_id) == 0)
 186                 {
 187                         /* seems to be a half ready ike_sa */
 188                         if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) ==
 189                                                   ike_sa_id->get_initiator_spi(ike_sa_id)) &&
 190                                 (current->ike_sa_id->is_initiator(ike_sa_id) ==
 191                                                   ike_sa_id->is_initiator(current->ike_sa_id)))
 192                         {
 193                                 DBG2(DBG_MGR, "found entry by initiator SPI");
 194                                 *entry = current;
 195                                 status = SUCCESS;
 196                                 break;
 197                         }
 198                 }
 199         }
 200
 201         iterator->destroy(iterator);
 202         return status;
 203 }
 204
 205 /**
 206  * Implementation of private_ike_sa_manager_t.get_entry_by_sa.
 207  */
 208 static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa, entry_t **entry)
 209 {
 210         linked_list_t *list = this->ike_sa_list;
 211         iterator_t *iterator;
 212         entry_t *current;
 213         status_t status;
 214
 215         iterator = list->create_iterator(list, TRUE);
 216
 217         /* default status */
 218         status = NOT_FOUND;
 219
 220         while (iterator->iterate(iterator, (void**)&current))
 221         {
 222                 /* only pointers are compared */
 223                 if (current->ike_sa == ike_sa)
 224                 {
 225                         DBG2(DBG_MGR, "found entry by pointer");
 226                         *entry = current;
 227                         status = SUCCESS;
 228                         break;
 229                 }
 230         }
 231         iterator->destroy(iterator);
 232
 233         return status;
 234 }
 235
 236 /**
 237  * Implementation of private_ike_sa_manager_s.delete_entry.
 238  */
 239 static status_t delete_entry(private_ike_sa_manager_t *this, entry_t *entry)
 240 {
 241         linked_list_t *list = this->ike_sa_list;
 242         iterator_t *iterator;
 243         entry_t *current;
 244         status_t status;
 245
 246         iterator = list->create_iterator(list, TRUE);
 247
 248         status = NOT_FOUND;
 249
 250         while (iterator->iterate(iterator, (void**)&current))
 251         {
 252                 if (current == entry)
 253                 {
 254                         /* mark it, so now new threads can get this entry */
 255                         entry->driveout_new_threads = TRUE;
 256                         /* wait until all workers have done their work */
 257                         while (entry->waiting_threads)
 258                         {
 259                                 /* wake up all */
 260                                 pthread_cond_broadcast(&(entry->condvar));
 261                                 /* they will wake us again when their work is done */
 262                                 pthread_cond_wait(&(entry->condvar), &(this->mutex));
 263                         }
 264
 265                         DBG2(DBG_MGR,  "found entry by pointer, deleting it");
 266                         iterator->remove(iterator);
 267                         entry_destroy(entry);
 268                         status = SUCCESS;
 269                         break;
 270                 }
 271         }
 272         iterator->destroy(iterator);
 273         return status;
 274 }
 275
 276 /**
 277  * Wait until no other thread is using an IKE_SA, return FALSE if entry not
 278  * acquireable
 279  */
 280 static bool wait_for_entry(private_ike_sa_manager_t *this, entry_t *entry)
 281 {
 282         if (entry->driveout_new_threads)
 283         {
 284                 /* we are not allowed to get this */
 285                 return FALSE;
 286         }
 287         while (entry->checked_out && !entry->driveout_waiting_threads)
 288         {
 289                 /* so wait until we can get it for us.
 290                  * we register us as waiting. */
 291                 entry->waiting_threads++;
 292                 pthread_cond_wait(&(entry->condvar), &(this->mutex));
 293                 entry->waiting_threads--;
 294         }
 295         /* hm, a deletion request forbids us to get this SA, get next one */
 296         if (entry->driveout_waiting_threads)
 297         {
 298                 /* we must signal here, others may be waiting on it, too */
 299                 pthread_cond_signal(&(entry->condvar));
 300                 return FALSE;
 301         }
 302         return TRUE;
 303 }
 304
 305 /**
 306  * Implementation of private_ike_sa_manager_t.get_next_spi.
 307  */
 308 static u_int64_t get_next_spi(private_ike_sa_manager_t *this)
 309 {
 310         u_int64_t spi;
 311
 312         this->randomizer->get_pseudo_random_bytes(this->randomizer, sizeof(spi),
 313                                                                                           (u_int8_t*)&spi);
 314         return spi;
 315 }
 316
 317 /**
 318  * Implementation of of ike_sa_manager.checkout.
 319  */
 320 static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
 321 {
 322         ike_sa_t *ike_sa = NULL;
 323         entry_t *entry;
 324
 325         DBG2(DBG_MGR, "checkout IKE_SA: %J, %d IKE_SAs in manager",
 326                  ike_sa_id, this->ike_sa_list->get_count(this->ike_sa_list));
 327
 328         pthread_mutex_lock(&(this->mutex));
 329         if (get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
 330         {
 331                 if (wait_for_entry(this, entry))
 332                 {
 333                         DBG2(DBG_MGR, "IKE_SA successfully checked out");
 334                         entry->checked_out = TRUE;
 335                         ike_sa = entry->ike_sa;
 336                 }
 337         }
 338         pthread_mutex_unlock(&this->mutex);
 339         charon->bus->set_sa(charon->bus, ike_sa);
 340         return ike_sa;
 341 }
 342
 343 /**
 344  * Implementation of of ike_sa_manager.checkout_new.
 345  */
 346 static ike_sa_t *checkout_new(private_ike_sa_manager_t* this, bool initiator)
 347 {
 348         entry_t *entry;
 349         ike_sa_id_t *id;
 350
 351         if (initiator)
 352         {
 353                 id = ike_sa_id_create(get_next_spi(this), 0, TRUE);
 354         }
 355         else
 356         {
 357                 id = ike_sa_id_create(0, get_next_spi(this), FALSE);
 358         }
 359         entry = entry_create(id);
 360         pthread_mutex_lock(&this->mutex);
 361         this->ike_sa_list->insert_last(this->ike_sa_list, entry);
 362         entry->checked_out = TRUE;
 363         pthread_mutex_unlock(&this->mutex);
 364         DBG2(DBG_MGR, "created IKE_SA: %J, %d IKE_SAs in manager",
 365                  id, this->ike_sa_list->get_count(this->ike_sa_list));
 366         id->destroy(id);
 367         return entry->ike_sa;
 368 }
 369
 370 /**
 371  * Implementation of of ike_sa_manager.checkout_by_id.
 372  */
 373 static ike_sa_t* checkout_by_message(private_ike_sa_manager_t* this,
 374                                                                          message_t *message)
 375 {
 376         entry_t *entry;
 377         ike_sa_t *ike_sa = NULL;
 378         ike_sa_id_t *id = message->get_ike_sa_id(message);
 379         id = id->clone(id);
 380         id->switch_initiator(id);
 381
 382         DBG2(DBG_MGR, "checkout IKE_SA: %J by message, %d IKE_SAs in manager",
 383                  id, this->ike_sa_list->get_count(this->ike_sa_list));
 384
 385         if (message->get_request(message) &&
 386                 message->get_exchange_type(message) == IKE_SA_INIT)
 387         {
 388                 /* IKE_SA_INIT request. Check for an IKE_SA with such a message hash. */
 389                 iterator_t *iterator;
 390                 chunk_t data, hash;
 391
 392                 data = message->get_packet_data(message);
 393                 this->hasher->allocate_hash(this->hasher, data, &hash);
 394                 chunk_free(&data);
 395
 396                 pthread_mutex_lock(&this->mutex);
 397                 iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 398                 while (iterator->iterate(iterator, (void**)&entry))
 399                 {
 400                         if (chunk_equals(hash, entry->init_hash))
 401                         {
 402                                 if (entry->message_id == 0)
 403                                 {
 404                                         iterator->destroy(iterator);
 405                                         pthread_mutex_unlock(&this->mutex);
 406                                         chunk_free(&hash);
 407                                         id->destroy(id);
 408                                         DBG1(DBG_MGR, "ignoring IKE_SA_INIT, already processing");
 409                                         return NULL;
 410                                 }
 411                                 else if (wait_for_entry(this, entry))
 412                                 {
 413                                         DBG2(DBG_MGR, "IKE_SA checked out by hash");
 414                                         entry->checked_out = TRUE;
 415                                         entry->message_id = message->get_message_id(message);
 416                                         ike_sa = entry->ike_sa;
 417                                 }
 418                                 break;
 419                         }
 420                 }
 421                 iterator->destroy(iterator);
 422                 pthread_mutex_unlock(&this->mutex);
 423
 424                 if (ike_sa == NULL)
 425                 {
 426                         if (id->get_responder_spi(id) == 0 &&
 427                                 message->get_exchange_type(message) == IKE_SA_INIT)
 428                         {
 429                                 /* no IKE_SA found, create a new one */
 430                                 id->set_responder_spi(id, get_next_spi(this));
 431                                 entry = entry_create(id);
 432
 433                                 pthread_mutex_lock(&this->mutex);
 434                                 this->ike_sa_list->insert_last(this->ike_sa_list, entry);
 435                                 entry->checked_out = TRUE;
 436                                 entry->message_id = message->get_message_id(message);
 437                                 pthread_mutex_unlock(&this->mutex);
 438                                 entry->init_hash = hash;
 439                                 ike_sa = entry->ike_sa;
 440                         }
 441                         else
 442                         {
 443                                 DBG1(DBG_MGR, "ignoring message for %J, no such IKE_SA", id);
 444                         }
 445                 }
 446                 else
 447                 {
 448                         chunk_free(&hash);
 449                 }
 450                 id->destroy(id);
 451                 charon->bus->set_sa(charon->bus, ike_sa);
 452                 return ike_sa;
 453         }
 454
 455         pthread_mutex_lock(&(this->mutex));
 456         if (get_entry_by_id(this, id, &entry) == SUCCESS)
 457         {
 458                 /* only check out if we are not processing this request */
 459                 if (message->get_request(message) &&
 460                         message->get_message_id(message) == entry->message_id)
 461                 {
 462                         DBG1(DBG_MGR, "ignoring request with ID %d, already processing",
 463                                  entry->message_id);
 464                 }
 465                 else if (wait_for_entry(this, entry))
 466                 {
 467                         ike_sa_id_t *ike_id = entry->ike_sa->get_id(entry->ike_sa);
 468                         DBG2(DBG_MGR, "IKE_SA successfully checked out");
 469                         entry->checked_out = TRUE;
 470                         entry->message_id = message->get_message_id(message);
 471                         if (ike_id->get_responder_spi(ike_id) == 0)
 472                         {
 473                                 ike_id->set_responder_spi(ike_id, id->get_responder_spi(id));
 474                         }
 475                         ike_sa = entry->ike_sa;
 476                 }
 477         }
 478         pthread_mutex_unlock(&this->mutex);
 479         id->destroy(id);
 480         charon->bus->set_sa(charon->bus, ike_sa);
 481         return ike_sa;
 482 }
 483
 484 /**
 485  * Implementation of of ike_sa_manager.checkout_by_id.
 486  */
 487 static ike_sa_t* checkout_by_peer(private_ike_sa_manager_t *this,
 488                                                                   host_t *my_host, host_t *other_host,
 489                                                                   identification_t *my_id,
 490                                                                   identification_t *other_id)
 491 {
 492         iterator_t *iterator;
 493         entry_t *entry;
 494         ike_sa_t *ike_sa = NULL;
 495
 496         pthread_mutex_lock(&(this->mutex));
 497
 498         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 499         while (iterator->iterate(iterator, (void**)&entry))
 500         {
 501                 identification_t *found_my_id, *found_other_id;
 502                 host_t *found_my_host, *found_other_host;
 503                 int wc;
 504
 505                 if (!wait_for_entry(this, entry))
 506                 {
 507                         continue;
 508                 }
 509
 510                 if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING)
 511                 {
 512                         /* skip IKE_SA which are not useable */
 513                         continue;
 514                 }
 515
 516                 found_my_id = entry->ike_sa->get_my_id(entry->ike_sa);
 517                 found_other_id = entry->ike_sa->get_other_id(entry->ike_sa);
 518                 found_my_host = entry->ike_sa->get_my_host(entry->ike_sa);
 519                 found_other_host = entry->ike_sa->get_other_host(entry->ike_sa);
 520
 521                 if (found_my_id->get_type(found_my_id) == ID_ANY &&
 522                         found_other_id->get_type(found_other_id) == ID_ANY)
 523                 {
 524                         /* IKE_SA has no IDs yet, so we can't use it */
 525                         continue;
 526                 }
 527
 528                 /* compare ID and hosts. Supplied ID may contain wildcards, and IP
 529                  * may be %any. */
 530                 if ((found_my_host->is_anyaddr(found_my_host) ||
 531                          my_host->ip_equals(my_host, found_my_host)) &&
 532                         (found_other_host->is_anyaddr(found_other_host) ||
 533                          other_host->ip_equals(other_host, found_other_host)) &&
 534                         found_my_id->matches(found_my_id, my_id, &wc) &&
 535                         found_other_id->matches(found_other_id, other_id, &wc))
 536                 {
 537                         /* looks good, we take this one */
 538                         DBG2(DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
 539                                  my_host, other_host, my_id, other_id);
 540                         entry->checked_out = TRUE;
 541                         ike_sa = entry->ike_sa;
 542                 }
 543         }
 544         iterator->destroy(iterator);
 545
 546         if (!ike_sa)
 547         {
 548                 u_int64_t initiator_spi;
 549                 entry_t *new_entry;
 550                 ike_sa_id_t *new_ike_sa_id;
 551
 552                 initiator_spi = get_next_spi(this);
 553                 new_ike_sa_id = ike_sa_id_create(0, 0, TRUE);
 554                 new_ike_sa_id->set_initiator_spi(new_ike_sa_id, initiator_spi);
 555
 556                 /* create entry */
 557                 new_entry = entry_create(new_ike_sa_id);
 558                 DBG2(DBG_MGR, "created IKE_SA: %J", new_ike_sa_id);
 559                 new_ike_sa_id->destroy(new_ike_sa_id);
 560
 561                 this->ike_sa_list->insert_last(this->ike_sa_list, new_entry);
 562
 563                 /* check ike_sa out */
 564                 DBG2(DBG_MGR, "new IKE_SA created for IDs [%D]...[%D]", my_id, other_id);
 565                 new_entry->checked_out = TRUE;
 566                 ike_sa = new_entry->ike_sa;
 567         }
 568         pthread_mutex_unlock(&(this->mutex));
 569         charon->bus->set_sa(charon->bus, ike_sa);
 570         return ike_sa;
 571 }
 572
 573 /**
 574  * Implementation of of ike_sa_manager.checkout_by_id.
 575  */
 576 static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this, u_int32_t id,
 577                                                                 bool child)
 578 {
 579         iterator_t *iterator, *children;
 580         entry_t *entry;
 581         ike_sa_t *ike_sa = NULL;
 582         child_sa_t *child_sa;
 583
 584         pthread_mutex_lock(&(this->mutex));
 585
 586         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 587         while (iterator->iterate(iterator, (void**)&entry))
 588         {
 589                 if (wait_for_entry(this, entry))
 590                 {
 591                         /* look for a child with such a reqid ... */
 592                         if (child)
 593                         {
 594                                 children = entry->ike_sa->create_child_sa_iterator(entry->ike_sa);
 595                                 while (children->iterate(children, (void**)&child_sa))
 596                                 {
 597                                         if (child_sa->get_reqid(child_sa) == id)
 598                                         {
 599                                                 ike_sa = entry->ike_sa;
 600                                                 break;
 601                                         }
 602                                 }
 603                                 children->destroy(children);
 604                         }
 605                         else /* ... or for a IKE_SA with such a unique id */
 606                         {
 607                                 if (entry->ike_sa->get_unique_id(entry->ike_sa) == id)
 608                                 {
 609                                         ike_sa = entry->ike_sa;
 610                                 }
 611                         }
 612                         /* got one, return */
 613                         if (ike_sa)
 614                         {
 615                                 entry->checked_out = TRUE;
 616                                 break;
 617                         }
 618                 }
 619         }
 620         iterator->destroy(iterator);
 621         pthread_mutex_unlock(&(this->mutex));
 622
 623         charon->bus->set_sa(charon->bus, ike_sa);
 624         return ike_sa;
 625 }
 626
 627 /**
 628  * Implementation of of ike_sa_manager.checkout_by_name.
 629  */
 630 static ike_sa_t* checkout_by_name(private_ike_sa_manager_t *this, char *name,
 631                                                                   bool child)
 632 {
 633         iterator_t *iterator, *children;
 634         entry_t *entry;
 635         ike_sa_t *ike_sa = NULL;
 636         child_sa_t *child_sa;
 637
 638         pthread_mutex_lock(&(this->mutex));
 639
 640         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 641         while (iterator->iterate(iterator, (void**)&entry))
 642         {
 643                 if (wait_for_entry(this, entry))
 644                 {
 645                         /* look for a child with such a policy name ... */
 646                         if (child)
 647                         {
 648                                 children = entry->ike_sa->create_child_sa_iterator(entry->ike_sa);
 649                                 while (children->iterate(children, (void**)&child_sa))
 650                                 {
 651                                         if (streq(child_sa->get_name(child_sa), name))
 652                                         {
 653                                                 ike_sa = entry->ike_sa;
 654                                                 break;
 655                                         }
 656                                 }
 657                                 children->destroy(children);
 658                         }
 659                         else /* ... or for a IKE_SA with such a connection name */
 660                         {
 661                                 if (streq(entry->ike_sa->get_name(entry->ike_sa), name))
 662                                 {
 663                                         ike_sa = entry->ike_sa;
 664                                 }
 665                         }
 666                         /* got one, return */
 667                         if (ike_sa)
 668                         {
 669                                 entry->checked_out = TRUE;
 670                                 break;
 671                         }
 672                 }
 673         }
 674         iterator->destroy(iterator);
 675         pthread_mutex_unlock(&(this->mutex));
 676
 677         charon->bus->set_sa(charon->bus, ike_sa);
 678         return ike_sa;
 679 }
 680
 681 /**
 682  * Iterator hook for iterate, gets ike_sas instead of entries
 683  */
 684 static bool iterator_hook(private_ike_sa_manager_t* this, entry_t *in,
 685                                                   ike_sa_t **out)
 686 {
 687         /* check out entry */
 688         if (wait_for_entry(this, in))
 689         {
 690                 *out = in->ike_sa;
 691                 return TRUE;
 692         }
 693         return FALSE;
 694 }
 695
 696 /**
 697  * Implementation of ike_sa_manager_t.create_iterator.
 698  */
 699 static iterator_t *create_iterator(private_ike_sa_manager_t* this)
 700 {
 701         iterator_t *iterator = this->ike_sa_list->create_iterator_locked(
 702                                                                                         this->ike_sa_list, &this->mutex);
 703         /* register hook to iterator over ike_sas, not entries */
 704         iterator->set_iterator_hook(iterator, (iterator_hook_t*)iterator_hook, this);
 705         return iterator;
 706 }
 707
 708 /**
 709  * Implementation of ike_sa_manager_t.checkin.
 710  */
 711 static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 712 {
 713         /* to check the SA back in, we look for the pointer of the ike_sa
 714          * in all entries.
 715          * We can't search by SPI's since the MAY have changed (e.g. on reception
 716          * of a IKE_SA_INIT response). Updating of the SPI MAY be necessary...
 717          */
 718         status_t retval;
 719         entry_t *entry;
 720         ike_sa_id_t *ike_sa_id;
 721
 722         ike_sa_id = ike_sa->get_id(ike_sa);
 723
 724         DBG2(DBG_MGR, "checkin IKE_SA: %J", ike_sa_id);
 725
 726         pthread_mutex_lock(&(this->mutex));
 727
 728         /* look for the entry */
 729         if (get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
 730         {
 731                 /* ike_sa_id must be updated */
 732                 entry->ike_sa_id->replace_values(entry->ike_sa_id, ike_sa->get_id(ike_sa));
 733                 /* signal waiting threads */
 734                 entry->checked_out = FALSE;
 735                 entry->message_id = -1;
 736                 DBG2(DBG_MGR, "check-in of IKE_SA successful.");
 737                 pthread_cond_signal(&(entry->condvar));
 738                 retval = SUCCESS;
 739         }
 740         else
 741         {
 742                 DBG2(DBG_MGR, "tried to check in nonexisting IKE_SA");
 743                 /* this SA is no more, this REALLY should not happen */
 744                 retval = NOT_FOUND;
 745         }
 746
 747         DBG2(DBG_MGR, "%d IKE_SAs in manager now",
 748                  this->ike_sa_list->get_count(this->ike_sa_list));
 749         pthread_mutex_unlock(&(this->mutex));
 750
 751         charon->bus->set_sa(charon->bus, NULL);
 752         return retval;
 753 }
 754
 755
 756 /**
 757  * Implementation of ike_sa_manager_t.checkin_and_destroy.
 758  */
 759 static status_t checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 760 {
 761         /* deletion is a bit complex, we must garant that no thread is waiting for
 762          * this SA.
 763          * We take this SA from the list, and start signaling while threads
 764          * are in the condvar.
 765          */
 766         entry_t *entry;
 767         status_t retval;
 768         ike_sa_id_t *ike_sa_id;
 769
 770         ike_sa_id = ike_sa->get_id(ike_sa);
 771         DBG2(DBG_MGR, "checkin and destroy IKE_SA: %J", ike_sa_id);
 772
 773         pthread_mutex_lock(&(this->mutex));
 774
 775         if (get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
 776         {
 777                 /* drive out waiting threads, as we are in hurry */
 778                 entry->driveout_waiting_threads = TRUE;
 779
 780                 delete_entry(this, entry);
 781
 782                 DBG2(DBG_MGR, "check-in and destroy of IKE_SA successful");
 783                 retval = SUCCESS;
 784         }
 785         else
 786         {
 787                 DBG2(DBG_MGR, "tried to check-in and delete nonexisting IKE_SA");
 788                 retval = NOT_FOUND;
 789         }
 790
 791         pthread_mutex_unlock(&(this->mutex));
 792         charon->bus->set_sa(charon->bus, ike_sa);
 793         return retval;
 794 }
 795
 796 /**
 797  * Implementation of ike_sa_manager_t.get_half_open_count.
 798  */
 799 static int get_half_open_count(private_ike_sa_manager_t *this, host_t *ip)
 800 {
 801         iterator_t *iterator;
 802         entry_t *entry;
 803         int count = 0;
 804
 805         pthread_mutex_lock(&(this->mutex));
 806         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 807         while (iterator->iterate(iterator, (void**)&entry))
 808         {
 809                 /* we check if we have a responder CONNECTING IKE_SA without checkout */
 810                 if (!entry->ike_sa_id->is_initiator(entry->ike_sa_id) &&
 811                         entry->ike_sa->get_state(entry->ike_sa) == IKE_CONNECTING)
 812                 {
 813                         /* if we have a host, we have wait until no other uses the IKE_SA */
 814                         if (ip)
 815                         {
 816                                 if (wait_for_entry(this, entry) && ip->ip_equals(ip,
 817                                                                 entry->ike_sa->get_other_host(entry->ike_sa)))
 818                                 {
 819                                         count++;
 820                                 }
 821                         }
 822                         else
 823                         {
 824                                 count++;
 825                         }
 826                 }
 827         }
 828         iterator->destroy(iterator);
 829
 830         pthread_mutex_unlock(&(this->mutex));
 831         return count;
 832 }
 833
 834 /**
 835  * Implementation of ike_sa_manager_t.destroy.
 836  */
 837 static void destroy(private_ike_sa_manager_t *this)
 838 {
 839         /* destroy all list entries */
 840         linked_list_t *list = this->ike_sa_list;
 841         iterator_t *iterator;
 842         entry_t *entry;
 843
 844         pthread_mutex_lock(&(this->mutex));
 845         DBG2(DBG_MGR, "going to destroy IKE_SA manager and all managed IKE_SA's");
 846         /* Step 1: drive out all waiting threads  */
 847         DBG2(DBG_MGR, "set driveout flags for all stored IKE_SA's");
 848         iterator = list->create_iterator(list, TRUE);
 849         while (iterator->iterate(iterator, (void**)&entry))
 850         {
 851                 /* do not accept new threads, drive out waiting threads */
 852                 entry->driveout_new_threads = TRUE;
 853                 entry->driveout_waiting_threads = TRUE;
 854         }
 855         DBG2(DBG_MGR, "wait for all threads to leave IKE_SA's");
 856         /* Step 2: wait until all are gone */
 857         iterator->reset(iterator);
 858         while (iterator->iterate(iterator, (void**)&entry))
 859         {
 860                 while (entry->waiting_threads)
 861                 {
 862                         /* wake up all */
 863                         pthread_cond_broadcast(&(entry->condvar));
 864                         /* go sleeping until they are gone */
 865                         pthread_cond_wait(&(entry->condvar), &(this->mutex));
 866                 }
 867         }
 868         DBG2(DBG_MGR, "delete all IKE_SA's");
 869         /* Step 3: initiate deletion of all IKE_SAs */
 870         iterator->reset(iterator);
 871         while (iterator->iterate(iterator, (void**)&entry))
 872         {
 873                 entry->ike_sa->delete(entry->ike_sa);
 874         }
 875         iterator->destroy(iterator);
 876
 877         DBG2(DBG_MGR, "destroy all entries");
 878         /* Step 4: destroy all entries */
 879         list->destroy_function(list, (void*)entry_destroy);
 880         pthread_mutex_unlock(&(this->mutex));
 881
 882         this->randomizer->destroy(this->randomizer);
 883         this->hasher->destroy(this->hasher);
 884
 885         free(this);
 886 }
 887
 888 /*
 889  * Described in header.
 890  */
 891 ike_sa_manager_t *ike_sa_manager_create()
 892 {
 893         private_ike_sa_manager_t *this = malloc_thing(private_ike_sa_manager_t);
 894
 895         /* assign public functions */
 896         this->public.destroy = (void(*)(ike_sa_manager_t*))destroy;
 897         this->public.checkout = (ike_sa_t*(*)(ike_sa_manager_t*, ike_sa_id_t*))checkout;
 898         this->public.checkout_new = (ike_sa_t*(*)(ike_sa_manager_t*,bool))checkout_new;
 899         this->public.checkout_by_message = (ike_sa_t*(*)(ike_sa_manager_t*,message_t*))checkout_by_message;
 900         this->public.checkout_by_peer = (ike_sa_t*(*)(ike_sa_manager_t*,host_t*,host_t*,identification_t*,identification_t*))checkout_by_peer;
 901         this->public.checkout_by_id = (ike_sa_t*(*)(ike_sa_manager_t*,u_int32_t,bool))checkout_by_id;
 902         this->public.checkout_by_name = (ike_sa_t*(*)(ike_sa_manager_t*,char*,bool))checkout_by_name;
 903         this->public.create_iterator = (iterator_t*(*)(ike_sa_manager_t*))create_iterator;
 904         this->public.checkin = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin;
 905         this->public.checkin_and_destroy = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin_and_destroy;
 906         this->public.get_half_open_count = (int(*)(ike_sa_manager_t*,host_t*))get_half_open_count;
 907
 908         /* initialize private variables */
 909         this->ike_sa_list = linked_list_create();
 910         pthread_mutex_init(&this->mutex, NULL);
 911         this->randomizer = randomizer_create();
 912         this->hasher = hasher_create(HASH_SHA1);
 913
 914         return &this->public;
 915 }