programs/charon/charon/sa/ike_sa_manager.c

   1 /**
   2  * @file ike_sa_manager.c
   3  *
   4  * @brief Implementation of ike_sa_mananger_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005 Jan Hutter, Martin Willi
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #include <pthread.h>
  24 #include <string.h>
  25
  26 #include "ike_sa_manager.h"
  27
  28 #include <daemon.h>
  29 #include <sa/ike_sa_id.h>
  30 #include <utils/logger.h>
  31 #include <utils/logger_manager.h>
  32 #include <utils/linked_list.h>
  33
  34 typedef struct ike_sa_entry_t ike_sa_entry_t;
  35
  36 /**
  37  * An entry in the linked list, contains IKE_SA, locking and lookup data.
  38  */
  39 struct ike_sa_entry_t {
  40         /**
  41          * Destructor, also destroys associated ike_sa_t object.
  42          */
  43         status_t (*destroy) (ike_sa_entry_t *this);
  44
  45         /**
  46          * Number of threads waiting for this ike_sa_t object.
  47          */
  48         int waiting_threads;
  49
  50         /**
  51          * Condvar where threads can wait until ike_sa_t object is free for use again.
  52          */
  53         pthread_cond_t condvar;
  54
  55         /**
  56          * Is this ike_sa currently checked out?
  57          */
  58         bool checked_out;
  59
  60         /**
  61          * Does this SA drives out new threads?
  62          */
  63         bool driveout_new_threads;
  64
  65         /**
  66          * Does this SA drives out waiting threads?
  67          */
  68         bool driveout_waiting_threads;
  69
  70         /**
  71          * Identifiaction of an IKE_SA (SPIs).
  72          */
  73         ike_sa_id_t *ike_sa_id;
  74
  75         /**
  76          * The contained ike_sa_t object.
  77          */
  78         ike_sa_t *ike_sa;
  79 };
  80
  81 /**
  82  * Implementation of ike_sa_entry_t.destroy.
  83  */
  84 static status_t ike_sa_entry_destroy(ike_sa_entry_t *this)
  85 {
  86         /* also destroy IKE SA */
  87         this->ike_sa->destroy(this->ike_sa);
  88         this->ike_sa_id->destroy(this->ike_sa_id);
  89         free(this);
  90         return SUCCESS;
  91 }
  92
  93 /**
  94  * @brief Creates a new entry for the ike_sa_t list.
  95  *
  96  * This constructor additionaly creates a new and empty SA.
  97  *
  98  * @param ike_sa_id             The associated ike_sa_id_t, will be cloned
  99  * @return                              ike_sa_entry_t object
 100  */
 101 static ike_sa_entry_t *ike_sa_entry_create(ike_sa_id_t *ike_sa_id)
 102 {
 103         ike_sa_entry_t *this = malloc_thing(ike_sa_entry_t);
 104
 105         /* destroy function */
 106         this->destroy = ike_sa_entry_destroy;
 107
 108         this->waiting_threads = 0;
 109         pthread_cond_init(&(this->condvar), NULL);
 110
 111         /* we set checkout flag when we really give it out */
 112         this->checked_out = FALSE;
 113         this->driveout_new_threads = FALSE;
 114         this->driveout_waiting_threads = FALSE;
 115
 116         /* ike_sa_id is always cloned */
 117         this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
 118
 119         /* create new ike_sa */
 120         this->ike_sa = ike_sa_create(ike_sa_id);
 121
 122         return this;
 123 }
 124
 125
 126 typedef struct private_ike_sa_manager_t private_ike_sa_manager_t;
 127
 128 /**
 129  * Additional private members of ike_sa_manager_t.
 130  */
 131 struct private_ike_sa_manager_t {
 132         /**
 133          * Public interface of ike_sa_manager_t.
 134          */
 135          ike_sa_manager_t public;
 136
 137         /**
 138          * @brief Get next spi.
 139          *
 140          * We give out SPIs incremental starting at 1.
 141          *
 142          * @param this                  the ike_sa_manager
 143          * @return                              the next spi
 144          */
 145         u_int64_t (*get_next_spi) (private_ike_sa_manager_t *this);
 146
 147         /**
 148          * @brief Find the ike_sa_entry_t object in the list by SPIs.
 149          *
 150          * This function simply iterates over the linked list. A hash-table
 151          * would be more efficient when storing a lot of IKE_SAs...
 152          *
 153          * @param this                  calling object
 154          * @param ike_sa_id             id of the ike_sa, containing SPIs
 155          * @param[out] entry    pointer to set to the found entry
 156          * @return
 157          *                                              - SUCCESS when found,
 158          *                                              - NOT_FOUND when no such ike_sa_id in list
 159          */
 160          status_t (*get_entry_by_id) (private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_entry_t **entry);
 161
 162          /**
 163          * @brief Find the ike_sa_entry_t in the list by pointer to SA.
 164          *
 165          * This function simply iterates over the linked list. A hash-table
 166          * would be more efficient when storing a lot of IKE_SAs...
 167          *
 168          * @param this                  calling object
 169          * @param ike_sa                pointer to the ike_sa
 170          * @param[out] entry    pointer to set to the found entry
 171          * @return
 172          *                                              - SUCCESS when found,
 173          *                                              - NOT_FOUND when no such ike_sa_id in list
 174          */
 175          status_t (*get_entry_by_sa) (private_ike_sa_manager_t *this, ike_sa_t *ike_sa, ike_sa_entry_t **entry);
 176
 177          /**
 178           * @brief Felete an entry from the linked list.
 179           *
 180           * @param this                 calling object
 181           * @param entry                entry to delete
 182           * @return
 183           *                                     - SUCCESS when found,
 184           *                                     - NOT_FOUND when no such ike_sa_id in list
 185           */
 186          status_t (*delete_entry) (private_ike_sa_manager_t *this, ike_sa_entry_t *entry);
 187
 188          /**
 189           * Lock for exclusivly accessing the manager.
 190           */
 191          pthread_mutex_t mutex;
 192
 193          /**
 194           * Logger used for this IKE SA Manager.
 195           */
 196          logger_t *logger;
 197
 198          /**
 199           * Linked list with entries for the ike_sa_t objects.
 200           */
 201          linked_list_t *ike_sa_list;
 202
 203          /**
 204           * Next SPI, needed for incremental creation of SPIs.
 205           */
 206          u_int64_t next_spi;
 207 };
 208
 209 /**
 210  * Implementation of private_ike_sa_manager_t.get_entry_by_id.
 211  */
 212 static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_entry_t **entry)
 213 {
 214         linked_list_t *list = this->ike_sa_list;
 215         iterator_t *iterator;
 216         status_t status;
 217
 218         /* create iterator over list of ike_sa's */
 219         iterator = list->create_iterator(list, TRUE);
 220
 221         /* default status */
 222         status = NOT_FOUND;
 223
 224         while (iterator->has_next(iterator))
 225         {
 226                 ike_sa_entry_t *current;
 227
 228                 iterator->current(iterator, (void**)&current);
 229                 if (current->ike_sa_id->get_responder_spi(current->ike_sa_id) == 0)
 230                 {
 231                         /* seems to be a half ready ike_sa */
 232                         if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) == ike_sa_id->get_initiator_spi(ike_sa_id))
 233                                 && (ike_sa_id->is_initiator(ike_sa_id) == current->ike_sa_id->is_initiator(current->ike_sa_id)))
 234                         {
 235                                 this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by initiator spi %d",ike_sa_id->get_initiator_spi(ike_sa_id));
 236                                 *entry = current;
 237                                 status = SUCCESS;
 238                                 break;
 239                         }
 240                 }
 241                 else if (ike_sa_id->get_responder_spi(ike_sa_id) == 0)
 242                 {
 243                         if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) == ike_sa_id->get_initiator_spi(ike_sa_id))
 244                                 && (ike_sa_id->is_initiator(ike_sa_id) == current->ike_sa_id->is_initiator(current->ike_sa_id)))
 245                         {
 246                                 this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by initiator spi %d",ike_sa_id->get_initiator_spi(ike_sa_id));
 247                                 *entry = current;
 248                                 status = SUCCESS;
 249                                 break;
 250                         }
 251                 }
 252                 if (current->ike_sa_id->equals(current->ike_sa_id, ike_sa_id))
 253                 {
 254                         this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by full ID");
 255                         *entry = current;
 256                         status = SUCCESS;
 257                         break;
 258                 }
 259         }
 260
 261         iterator->destroy(iterator);
 262         return status;
 263 }
 264
 265 /**
 266  * Implementation of private_ike_sa_manager_t.get_entry_by_sa.
 267  */
 268 static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa, ike_sa_entry_t **entry)
 269 {
 270         linked_list_t *list = this->ike_sa_list;
 271         iterator_t *iterator;
 272         status_t status;
 273
 274         iterator = list->create_iterator(list, TRUE);
 275
 276         /* default status */
 277         status = NOT_FOUND;
 278
 279         while (iterator->has_next(iterator))
 280         {
 281                 ike_sa_entry_t *current;
 282                 iterator->current(iterator, (void**)&current);
 283                 /* only pointers are compared */
 284                 if (current->ike_sa == ike_sa)
 285                 {
 286                         this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by pointer");
 287                         *entry = current;
 288                         status = SUCCESS;
 289                         break;
 290                 }
 291         }
 292         iterator->destroy(iterator);
 293
 294         return status;
 295 }
 296
 297 /**
 298  * Implementation of private_ike_sa_manager_s.delete_entry.
 299  */
 300 static status_t delete_entry(private_ike_sa_manager_t *this, ike_sa_entry_t *entry)
 301 {
 302         linked_list_t *list = this->ike_sa_list;
 303         iterator_t *iterator;
 304         status_t status;
 305
 306         iterator = list->create_iterator(list, TRUE);
 307
 308         status = NOT_FOUND;
 309
 310         while (iterator->has_next(iterator))
 311         {
 312                 ike_sa_entry_t *current;
 313                 iterator->current(iterator, (void**)&current);
 314                 if (current == entry)
 315                 {
 316                         this->logger->log(this->logger,CONTROL | LEVEL2,"Found entry by pointer. Going to delete it.");
 317                         iterator->remove(iterator);
 318                         entry->destroy(entry);
 319                         status = SUCCESS;
 320                         break;
 321                 }
 322         }
 323         iterator->destroy(iterator);
 324         return status;
 325 }
 326
 327
 328 /**
 329  * Implementation of private_ike_sa_manager_t.get_next_spi.
 330  */
 331 static u_int64_t get_next_spi(private_ike_sa_manager_t *this)
 332 {
 333         this->next_spi++;
 334         if (this->next_spi == 0) {
 335                 /* TODO handle overflow,
 336                  * delete all SAs or so
 337                  */
 338         }
 339         return this->next_spi;
 340 }
 341
 342 /**
 343  * Implementation of of ike_sa_manager.create_and_checkout.
 344  */
 345 static void create_and_checkout(private_ike_sa_manager_t *this,ike_sa_t **ike_sa)
 346 {
 347         u_int64_t initiator_spi;
 348         ike_sa_entry_t *new_ike_sa_entry;
 349         ike_sa_id_t *new_ike_sa_id;
 350
 351         initiator_spi = this->get_next_spi(this);
 352         new_ike_sa_id = ike_sa_id_create(0, 0, TRUE);
 353         new_ike_sa_id->set_initiator_spi(new_ike_sa_id, initiator_spi);
 354
 355         /* create entry */
 356         new_ike_sa_entry = ike_sa_entry_create(new_ike_sa_id);
 357         new_ike_sa_id->destroy(new_ike_sa_id);
 358
 359         /* each access is locked */
 360         pthread_mutex_lock(&(this->mutex));
 361
 362         this->ike_sa_list->insert_last(this->ike_sa_list, new_ike_sa_entry);
 363
 364         /* check ike_sa out */
 365         this->logger->log(this->logger,CONTROL | LEVEL1 ,"New IKE_SA created and added to list of known IKE_SA's");
 366         new_ike_sa_entry->checked_out = TRUE;
 367         *ike_sa = new_ike_sa_entry->ike_sa;
 368
 369         pthread_mutex_unlock(&(this->mutex));
 370 }
 371
 372 /**
 373  * Implementation of of ike_sa_manager.checkout.
 374  */
 375 static status_t checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_t **ike_sa)
 376 {
 377         bool responder_spi_set;
 378         bool initiator_spi_set;
 379         bool original_initiator;
 380         status_t retval;
 381
 382         /* each access is locked */
 383         pthread_mutex_lock(&(this->mutex));
 384
 385         responder_spi_set = (FALSE != ike_sa_id->get_responder_spi(ike_sa_id));
 386         initiator_spi_set = (FALSE != ike_sa_id->get_initiator_spi(ike_sa_id));
 387         original_initiator = ike_sa_id->is_initiator(ike_sa_id);
 388
 389         if ((initiator_spi_set && responder_spi_set) ||
 390                 ((initiator_spi_set && !responder_spi_set) && (original_initiator)))
 391         {
 392                 /* we SHOULD have an IKE_SA for these SPIs in the list,
 393                  * if not, we can't handle the request...
 394                  */
 395                  ike_sa_entry_t *entry;
 396                  /* look for the entry */
 397                  if (this->get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
 398                  {
 399                         /* can we give this ike_sa out to new requesters?*/
 400                         if (entry->driveout_new_threads)
 401                         {
 402                                 this->logger->log(this->logger,CONTROL|LEVEL1,"Drive out new thread for existing IKE_SA");
 403                                 /* no we can't */
 404                                 retval = NOT_FOUND;
 405                         }
 406                         else
 407                         {
 408                                 /* is this IKE_SA already checked out ??
 409                                  * are we welcome to get this SA ? */
 410                                 while (entry->checked_out && !entry->driveout_waiting_threads)
 411                                 {
 412                                         /* so wait until we can get it for us.
 413                                          * we register us as waiting.
 414                                          */
 415                                         entry->waiting_threads++;
 416                                         pthread_cond_wait(&(entry->condvar), &(this->mutex));
 417                                         entry->waiting_threads--;
 418                                 }
 419
 420                                 /* hm, a deletion request forbids us to get this SA, go home */
 421                                 if (entry->driveout_waiting_threads)
 422                                 {
 423                                         /* we must signal here, others are interested that we leave */
 424                                         pthread_cond_signal(&(entry->condvar));
 425                                         this->logger->log(this->logger,CONTROL|LEVEL1,"Drive out waiting thread for existing IKE_SA");
 426                                         retval = NOT_FOUND;
 427                                 }
 428                                 else
 429                                 {
 430                                         this->logger->log(this->logger,CONTROL|LEVEL2,"IKE SA successfully checked out");
 431                                         /* ok, this IKE_SA is finally ours */
 432                                         entry->checked_out = TRUE;
 433                                         *ike_sa = entry->ike_sa;
 434                                         /* DON'T use return, we must unlock the mutex! */
 435                                         retval = SUCCESS;
 436                                 }
 437                         }
 438                 }
 439                 else
 440                 {
 441                         this->logger->log(this->logger,ERROR | LEVEL1,"IKE SA not stored in known IKE_SA list");
 442                         /* looks like there is no such IKE_SA, better luck next time... */
 443                         /* DON'T use return, we must unlock the mutex! */
 444                         retval = NOT_FOUND;
 445                 }
 446         }
 447         else if ((initiator_spi_set && !responder_spi_set) && (!original_initiator))
 448         {
 449                 /* an IKE_SA_INIT from an another endpoint,
 450                  * he is the initiator.
 451                  * For simplicity, we do NOT check for retransmitted
 452                  * IKE_SA_INIT-Requests here, so EVERY single IKE_SA_INIT-
 453                  * Request (even a retransmitted one) will result in a
 454                  * IKE_SA. This could be improved...
 455                  */
 456                 u_int64_t responder_spi;
 457                 ike_sa_entry_t *new_ike_sa_entry;
 458
 459
 460                 /* set SPIs, we are the responder */
 461                 responder_spi = this->get_next_spi(this);
 462
 463                 /* we also set arguments spi, so its still valid */
 464                 ike_sa_id->set_responder_spi(ike_sa_id, responder_spi);
 465
 466                 /* create entry */
 467                 new_ike_sa_entry = ike_sa_entry_create(ike_sa_id);
 468
 469                 this->ike_sa_list->insert_last(this->ike_sa_list, new_ike_sa_entry);
 470
 471                 /* check ike_sa out */
 472                 this->logger->log(this->logger,CONTROL | LEVEL1 ,"IKE_SA added to list of known IKE_SA's");
 473                 new_ike_sa_entry->checked_out = TRUE;
 474                 *ike_sa = new_ike_sa_entry->ike_sa;
 475
 476                 retval = CREATED;
 477         }
 478         else
 479         {
 480                 /* responder set, initiator not: here is something seriously wrong! */
 481                 this->logger->log(this->logger,ERROR | LEVEL1, "Invalid IKE_SA SPI's");
 482                 /* DON'T use return, we must unlock the mutex! */
 483                 retval = INVALID_ARG;
 484         }
 485
 486         pthread_mutex_unlock(&(this->mutex));
 487         /* OK, unlocked... */
 488         return retval;
 489 }
 490
 491 /**
 492  * Implementation of of ike_sa_manager.checkout_by_hosts.
 493  */
 494 static status_t checkout_by_hosts(private_ike_sa_manager_t *this, host_t *me, host_t *other, ike_sa_t **ike_sa)
 495 {
 496         iterator_t *iterator;
 497         ike_sa_id_t *ike_sa_id = NULL;
 498
 499         pthread_mutex_lock(&(this->mutex));
 500
 501         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 502         while (iterator->has_next(iterator))
 503         {
 504                 ike_sa_entry_t *current;
 505                 host_t *sa_me, *sa_other;
 506
 507                 iterator->current(iterator, (void**)&current);
 508                 sa_me = current->ike_sa->get_my_host(current->ike_sa);
 509                 sa_other = current->ike_sa->get_other_host(current->ike_sa);
 510
 511                 /* one end may be default/any, but not both */
 512                 if (me->is_default_route(me))
 513                 {
 514                         if (other->is_default_route(other))
 515                         {
 516                                 break;
 517                         }
 518                         if (other->equals(other, sa_other))
 519                         {
 520                                 /* other matches */
 521                                 ike_sa_id = current->ike_sa_id;
 522                         }
 523                 }
 524                 else if (other->is_default_route(other))
 525                 {
 526                         if (me->equals(me, sa_me))
 527                         {
 528                                 /* ME matches */
 529                                 ike_sa_id = current->ike_sa_id;
 530                         }
 531                 }
 532                 else
 533                 {
 534                         if (me->equals(me, sa_me) && other->equals(other, sa_other))
 535                         {
 536                                 /* both matches */
 537                                 ike_sa_id = current->ike_sa_id;
 538                         }
 539                 }
 540         }
 541         iterator->destroy(iterator);
 542         pthread_mutex_unlock(&(this->mutex));
 543
 544         if (ike_sa_id)
 545         {
 546                 /* checkout is done in the checkout function, since its rather complex */
 547                 return checkout(this, ike_sa_id, ike_sa);
 548         }
 549         return NOT_FOUND;
 550 }
 551
 552 /**
 553  * Implementation of ike_sa_manager_t.get_ike_sa_list.
 554  */
 555 linked_list_t *get_ike_sa_list(private_ike_sa_manager_t* this)
 556 {
 557         linked_list_t *list;
 558         iterator_t *iterator;
 559
 560         pthread_mutex_lock(&(this->mutex));
 561
 562         list = linked_list_create();
 563         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 564         while (iterator->has_next(iterator))
 565         {
 566                 ike_sa_entry_t *entry;
 567                 iterator->current(iterator, (void**)&entry);
 568                 list->insert_last(list, (void*)entry->ike_sa_id->clone(entry->ike_sa_id));
 569         }
 570         iterator->destroy(iterator);
 571
 572         pthread_mutex_unlock(&(this->mutex));
 573         return list;
 574 }
 575
 576 /**
 577  * Implementation of ike_sa_manager_t.log_status.
 578  */
 579 static void log_status(private_ike_sa_manager_t* this, logger_t* logger, char* name)
 580 {
 581         iterator_t *iterator;
 582
 583         pthread_mutex_lock(&(this->mutex));
 584
 585         iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 586         while (iterator->has_next(iterator))
 587         {
 588                 ike_sa_entry_t *entry;
 589                 iterator->current(iterator, (void**)&entry);
 590                 entry->ike_sa->log_status(entry->ike_sa, logger, name);
 591         }
 592         iterator->destroy(iterator);
 593
 594         pthread_mutex_unlock(&(this->mutex));
 595 }
 596
 597 /**
 598  * Implementation of ike_sa_manager_t.checkin.
 599  */
 600 static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 601 {
 602         /* to check the SA back in, we look for the pointer of the ike_sa
 603          * in all entries.
 604          * We can't search by SPI's since the MAY have changed (e.g. on reception
 605          * of a IKE_SA_INIT response). Updating of the SPI MAY be necessary...
 606          */
 607         status_t retval;
 608         ike_sa_entry_t *entry;
 609
 610         pthread_mutex_lock(&(this->mutex));
 611
 612         /* look for the entry */
 613         if (this->get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
 614         {
 615                 /* ike_sa_id must be updated */
 616                 entry->ike_sa_id->replace_values(entry->ike_sa_id, ike_sa->get_id(ike_sa));
 617                 /* signal waiting threads */
 618                 entry->checked_out = FALSE;
 619                 this->logger->log(this->logger,CONTROL | LEVEL1,"Checkin of IKE_SA successful.");
 620                 pthread_cond_signal(&(entry->condvar));
 621                 retval = SUCCESS;
 622         }
 623         else
 624         {
 625                 this->logger->log(this->logger,ERROR,"Fatal Error: Tried to checkin nonexisting IKE_SA");
 626                 /* this SA is no more, this REALLY should not happen */
 627                 retval = NOT_FOUND;
 628         }
 629         pthread_mutex_unlock(&(this->mutex));
 630         return retval;
 631 }
 632
 633
 634 /**
 635  * Implementation of ike_sa_manager_t.checkin_and_delete.
 636  */
 637 static status_t checkin_and_delete(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 638 {
 639         /* deletion is a bit complex, we must garant that no thread is waiting for
 640          * this SA.
 641          * We take this SA from the list, and start signaling while threads
 642          * are in the condvar.
 643          */
 644         ike_sa_entry_t *entry;
 645         status_t retval;
 646
 647         pthread_mutex_lock(&(this->mutex));
 648
 649         if (this->get_entry_by_sa(this, ike_sa, &entry) == SUCCESS)
 650         {
 651                 /* mark it, so now new threads can acquire this SA */
 652                 entry->driveout_new_threads = TRUE;
 653                 /* additionaly, drive out waiting threads */
 654                 entry->driveout_waiting_threads = TRUE;
 655
 656                 /* wait until all workers have done their work */
 657                 while (entry->waiting_threads > 0)
 658                 {
 659                         /* let the other threads do some work*/
 660                         pthread_cond_signal(&(entry->condvar));
 661                         /* and the nice thing, they will wake us again when their work is done */
 662                         pthread_cond_wait(&(entry->condvar), &(this->mutex));
 663                 }
 664                 /* ok, we are alone now, no threads waiting in the entry's condvar */
 665                 this->delete_entry(this, entry);
 666                 this->logger->log(this->logger,CONTROL | LEVEL1,"Checkin and delete of IKE_SA successful");
 667                 retval = SUCCESS;
 668         }
 669         else
 670         {
 671                 this->logger->log(this->logger,ERROR,"Fatal Error: Tried to checkin and delete nonexisting IKE_SA");
 672                 retval = NOT_FOUND;
 673         }
 674
 675         pthread_mutex_unlock(&(this->mutex));
 676         return retval;
 677 }
 678
 679 /**
 680  * Implementation of ike_sa_manager_t.delete.
 681  */
 682 static status_t delete(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
 683 {
 684         /* deletion is a bit complex, we must garant that no thread is waiting for
 685          * this SA.
 686          * We take this SA from the list, and start signaling while threads
 687          * are in the condvar.
 688          */
 689         ike_sa_entry_t *entry;
 690         status_t retval;
 691
 692         pthread_mutex_lock(&(this->mutex));
 693
 694         if (this->get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
 695         {
 696                 /* mark it, so now new threads can acquire this SA */
 697                 entry->driveout_new_threads = TRUE;
 698
 699                 /* wait until all workers have done their work */
 700                 while (entry->waiting_threads)
 701                 {
 702                         /* wake up all */
 703                         pthread_cond_signal(&(entry->condvar));
 704                         /* and the nice thing, they will wake us again when their work is done */
 705                         pthread_cond_wait(&(entry->condvar), &(this->mutex));
 706                 }
 707                 /* ok, we are alone now, no threads waiting in the entry's condvar */
 708                 this->delete_entry(this, entry);
 709                 this->logger->log(this->logger,CONTROL | LEVEL1,"Delete of IKE_SA successful");
 710                 retval = SUCCESS;
 711         }
 712         else
 713         {
 714                 this->logger->log(this->logger,ERROR,"Fatal Error: Tried to delete nonexisting IKE_SA");
 715                 retval = NOT_FOUND;
 716         }
 717
 718         pthread_mutex_unlock(&(this->mutex));
 719         return retval;
 720 }
 721
 722 /**
 723  * Implementation of ike_sa_manager_t.destroy.
 724  */
 725 static void destroy(private_ike_sa_manager_t *this)
 726 {
 727         /* destroy all list entries */
 728         linked_list_t *list = this->ike_sa_list;
 729         iterator_t *iterator;
 730         ike_sa_entry_t *entry;
 731
 732         pthread_mutex_lock(&(this->mutex));
 733
 734         this->logger->log(this->logger,CONTROL | LEVEL1,"Going to destroy IKE_SA manager and all managed IKE_SA's");
 735
 736         /* Step 1: drive out all waiting threads  */
 737         iterator = list->create_iterator(list, TRUE);
 738
 739         this->logger->log(this->logger,CONTROL | LEVEL2,"Set driveout flags for all stored IKE_SA's");
 740         while (iterator->has_next(iterator))
 741         {
 742                 iterator->current(iterator, (void**)&entry);
 743                 /* do not accept new threads, drive out waiting threads */
 744                 entry->driveout_new_threads = TRUE;
 745                 entry->driveout_waiting_threads = TRUE;
 746         }
 747
 748         this->logger->log(this->logger,CONTROL | LEVEL2,"Wait for all threads to leave IKE_SA's");
 749         /* Step 2: wait until all are gone */
 750         iterator->reset(iterator);
 751         while (iterator->has_next(iterator))
 752         {
 753                 iterator->current(iterator, (void**)&entry);
 754                 while (entry->waiting_threads)
 755                 {
 756                         /* wake up all */
 757                         pthread_cond_signal(&(entry->condvar));
 758                         /* go sleeping until they are gone */
 759                         pthread_cond_wait(&(entry->condvar), &(this->mutex));
 760                 }
 761         }
 762         this->logger->log(this->logger,CONTROL | LEVEL2,"Delete all IKE_SA's");
 763         /* Step 3: delete all entries */
 764         iterator->destroy(iterator);
 765
 766         while (list->get_count(list) > 0)
 767         {
 768                 list->get_first(list, (void**)&entry);
 769                 this->delete_entry(this, entry);
 770         }
 771         list->destroy(list);
 772         this->logger->log(this->logger,CONTROL | LEVEL2,"IKE_SA's deleted");
 773         pthread_mutex_unlock(&(this->mutex));
 774
 775         free(this);
 776 }
 777
 778 /*
 779  * Described in header.
 780  */
 781 ike_sa_manager_t *ike_sa_manager_create()
 782 {
 783         private_ike_sa_manager_t *this = malloc_thing(private_ike_sa_manager_t);
 784
 785         /* assign public functions */
 786         this->public.destroy = (void(*)(ike_sa_manager_t*))destroy;
 787         this->public.create_and_checkout = (void(*)(ike_sa_manager_t*,ike_sa_t**))create_and_checkout;
 788         this->public.checkout = (status_t(*)(ike_sa_manager_t*, ike_sa_id_t*,ike_sa_t**))checkout;
 789         this->public.checkout_by_hosts = (status_t(*)(ike_sa_manager_t*,host_t*,host_t*,ike_sa_t**))checkout_by_hosts;
 790         this->public.get_ike_sa_list = (linked_list_t*(*)(ike_sa_manager_t*))get_ike_sa_list;
 791         this->public.log_status = (void(*)(ike_sa_manager_t*,logger_t*,char*))log_status;
 792         this->public.checkin = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin;
 793         this->public.delete = (status_t(*)(ike_sa_manager_t*,ike_sa_id_t*))delete;
 794         this->public.checkin_and_delete = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin_and_delete;
 795
 796         /* initialize private functions */
 797         this->get_next_spi = get_next_spi;
 798         this->get_entry_by_sa = get_entry_by_sa;
 799         this->get_entry_by_id = get_entry_by_id;
 800         this->delete_entry = delete_entry;
 801
 802         /* initialize private variables */
 803         this->logger = logger_manager->get_logger(logger_manager, IKE_SA_MANAGER);
 804
 805         this->ike_sa_list = linked_list_create();
 806
 807         pthread_mutex_init(&(this->mutex), NULL);
 808
 809         this->next_spi = 0;
 810
 811         return (ike_sa_manager_t*)this;
 812 }