2 * Copyright (C) 2008 Tobias Brunner
3 * Copyright (C) 2005-2008 Martin Willi
4 * Copyright (C) 2005 Jan Hutter
5 * Hochschule fuer Technik Rapperswil
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
19 * @defgroup ike_sa_manager ike_sa_manager
23 #ifndef IKE_SA_MANAGER_H_
24 #define IKE_SA_MANAGER_H_
26 typedef struct ike_sa_manager_t ike_sa_manager_t
;
29 #include <sa/ike_sa.h>
30 #include <encoding/message.h>
31 #include <config/peer_cfg.h>
34 * Manages and synchronizes access to all IKE_SAs.
36 * To synchronize access to thread-unsave IKE_SAs, they are checked out for
37 * use and checked in afterwards. A checked out SA is exclusively accessible
38 * by the owning thread.
40 struct ike_sa_manager_t
{
43 * Checkout an existing IKE_SA.
45 * @param ike_sa_id the SA identifier, will be updated
47 * - checked out IKE_SA if found
48 * - NULL, if specified IKE_SA is not found.
50 ike_sa_t
* (*checkout
) (ike_sa_manager_t
* this, ike_sa_id_t
*sa_id
);
53 * Create and check out a new IKE_SA.
55 * @param version IKE version of this SA
56 * @param initiator TRUE for initiator, FALSE otherwise
57 * @returns created and checked out IKE_SA
59 ike_sa_t
* (*checkout_new
) (ike_sa_manager_t
* this, ike_version_t version
,
63 * Checkout an IKE_SA by a message.
65 * In some situations, it is necessary that the manager knows the
66 * message to use for the checkout. This has the following reasons:
68 * 1. If the targeted IKE_SA is already processing a message, we do not
69 * check it out if the message ID is the same.
70 * 2. If it is an IKE_SA_INIT request, we have to check if it is a
71 * retransmission. If so, we have to drop the message, we would
72 * create another unneeded IKE_SA for each retransmitted packet.
74 * A call to checkout_by_message() returns a (maybe new created) IKE_SA.
75 * If processing the message does not make sense (for the reasons above),
78 * @param ike_sa_id the SA identifier, will be updated
80 * - checked out/created IKE_SA
81 * - NULL to not process message further
83 ike_sa_t
* (*checkout_by_message
) (ike_sa_manager_t
* this, message_t
*message
);
86 * Checkout an IKE_SA for initiation by a peer_config.
88 * To initiate, a CHILD_SA may be established within an existing IKE_SA.
89 * This call checks for an existing IKE_SA by comparing the configuration.
90 * If the CHILD_SA can be created in an existing IKE_SA, the matching SA
92 * If no IKE_SA is found, a new one is created. This is also the case when
93 * the found IKE_SA is in the DELETING state.
95 * @param peer_cfg configuration used to find an existing IKE_SA
96 * @return checked out/created IKE_SA
98 ike_sa_t
* (*checkout_by_config
) (ike_sa_manager_t
* this,
99 peer_cfg_t
*peer_cfg
);
102 * Check for duplicates of the given IKE_SA.
104 * Measures are taken according to the uniqueness policy of the IKE_SA.
105 * The return value indicates whether duplicates have been found and if
106 * further measures should be taken (e.g. cancelling an IKE_AUTH exchange).
107 * check_uniqueness() must be called before the IKE_SA is complete,
108 * deadlocks occur otherwise.
110 * @param ike_sa ike_sa to check
111 * @param force_replace replace existing SAs, regardless of unique policy
112 * @return TRUE, if the given IKE_SA has duplicates and
115 bool (*check_uniqueness
)(ike_sa_manager_t
*this, ike_sa_t
*ike_sa
,
119 * Check if we already have a connected IKE_SA between two identities.
121 * @param me own identity
122 * @param other remote identity
123 * @param family address family to include in uniqueness check
124 * @return TRUE if we have a connected IKE_SA
126 bool (*has_contact
)(ike_sa_manager_t
*this, identification_t
*me
,
127 identification_t
*other
, int family
);
130 * Check out an IKE_SA a unique ID.
132 * Every IKE_SA is uniquely identified by a numerical ID. This checkout
133 * function uses the unique ID of the IKE_SA to check it out.
135 * @param id unique ID of the object
137 * - checked out IKE_SA, if found
138 * - NULL, if not found
140 ike_sa_t
* (*checkout_by_id
) (ike_sa_manager_t
* this, u_int32_t id
);
143 * Check out an IKE_SA by the policy/connection name.
145 * Check out the IKE_SA by the configuration name, either from the IKE- or
146 * one of its CHILD_SAs.
148 * @param name name of the connection/policy
149 * @param child TRUE to use policy name, FALSE to use conn name
151 * - checked out IKE_SA, if found
152 * - NULL, if not found
154 ike_sa_t
* (*checkout_by_name
) (ike_sa_manager_t
* this, char *name
,
158 * Create an enumerator over all stored IKE_SAs.
160 * While enumerating an IKE_SA, it is temporarily checked out and
161 * automatically checked in after the current enumeration step.
163 * @param wait TRUE to wait for checked out SAs, FALSE to skip
164 * @return enumerator over all IKE_SAs.
166 enumerator_t
*(*create_enumerator
) (ike_sa_manager_t
* this, bool wait
);
169 * Create an enumerator over ike_sa_id_t*, matching peer identities.
171 * The remote peer is identified by its XAuth or EAP identity, if available.
173 * @param me local peer identity to match
174 * @param other remote peer identity to match
175 * @param family address family to match, 0 for any
176 * @return enumerator over ike_sa_id_t*
178 enumerator_t
* (*create_id_enumerator
)(ike_sa_manager_t
*this,
179 identification_t
*me
, identification_t
*other
,
183 * Checkin the SA after usage.
185 * If the IKE_SA is not registered in the manager, a new entry is created.
187 * @param ike_sa_id the SA identifier, will be updated
188 * @param ike_sa checked out SA
190 void (*checkin
) (ike_sa_manager_t
* this, ike_sa_t
*ike_sa
);
193 * Destroy a checked out SA.
195 * The IKE SA is destroyed without notification of the remote peer.
196 * Use this only if the other peer doesn't respond or behaves not
198 * Checking in and destruction is an atomic operation (for the IKE_SA),
199 * so this can be called if the SA is in a "unclean" state, without the
200 * risk that another thread can get the SA.
202 * @param ike_sa SA to delete
204 void (*checkin_and_destroy
) (ike_sa_manager_t
* this, ike_sa_t
*ike_sa
);
207 * Get the number of IKE_SAs currently registered.
209 * @return number of registered IKE_SAs
211 u_int (*get_count
)(ike_sa_manager_t
*this);
214 * Get the number of IKE_SAs which are in the connecting state.
216 * To prevent the server from resource exhaustion, cookies and other
217 * mechanisms are used. The number of half open IKE_SAs is a good
218 * indicator to see if a peer is flooding the server.
219 * If a host is supplied, only the number of half open IKE_SAs initiated
220 * from this IP are counted.
221 * Only SAs for which we are the responder are counted.
223 * @param ip NULL for all, IP for half open IKE_SAs with IP
224 * @return number of half open IKE_SAs
226 u_int (*get_half_open_count
) (ike_sa_manager_t
*this, host_t
*ip
);
229 * Delete all existing IKE_SAs and destroy them immediately.
231 * Threads will be driven out, so all SAs can be deleted cleanly.
232 * To a flush(), an immediate call to destroy() is mandatory; no other
233 * method may be used.
235 void (*flush
)(ike_sa_manager_t
*this);
238 * Destroys the manager with all associated SAs.
240 * A call to flush() is required before calling destroy.
242 void (*destroy
) (ike_sa_manager_t
*this);
246 * Create the IKE_SA manager.
248 * @returns ike_sa_manager_t object, NULL if initialization fails
250 ike_sa_manager_t
*ike_sa_manager_create(void);
252 #endif /** IKE_SA_MANAGER_H_ @}*/