Changeset 4681

Timestamp:

11/20/08 14:30:23 (2 months ago)

Author:

tobias

Message:

optimized ike_sa_manager for concurrent access (default behavior is still as before, needs configuration in strongswan.conf).

Files:

• trunk/src/charon/sa/ike_sa_manager.c (modified) (49 diffs)

trunk/src/charon/sa/ike_sa_manager.c

@@ -28 +28 @@
-#include <crypto/hashers/hasher.h>
-
+/* the default size of the hash table (MUST be a power of 2) */
+#define DEFAULT_HASHTABLE_SIZE 1
+
+/* the maximum size of the hash table (MUST be a power of 2) */
+#define MAX_HASHTABLE_SIZE (1 << 30)
+
+/* the default number of segments (MUST be a power of 2) */
+#define DEFAULT_SEGMENT_COUNT 1
+
-typedef struct entry_t entry_t;
-
@@ -61 +70 @@
-    
-    /**
-ac
+ca
-     */
-    ike_sa_id_t *ike_sa_id;
@@ -142 +151 @@
-}
-
+/**
+ * Function that matches entry_t objects by initiator SPI and the hash of the
+ * IKE_SA_INIT message.
+ */
+static bool entry_match_by_hash(entry_t *entry, ike_sa_id_t *id, chunk_t *hash)
+{
+    return id->get_responder_spi(id) == 0 &&
+        id->is_initiator(id) == entry->ike_sa_id->is_initiator(entry->ike_sa_id) &&
+        id->get_initiator_spi(id) == entry->ike_sa_id->get_initiator_spi(entry->ike_sa_id) &&
+        chunk_equals(*hash, entry->init_hash);
+}
+
+/**
+ * Function that matches entry_t objects by ike_sa_id_t.
+ */
+static bool entry_match_by_id(entry_t *entry, ike_sa_id_t *id)
+{
+    if (id->equals(id, entry->ike_sa_id))
+    {
+        return TRUE;
+    }   
+    if (entry->ike_sa_id->get_responder_spi(entry->ike_sa_id) == 0 &&
+        id->is_initiator(id) == entry->ike_sa_id->is_initiator(entry->ike_sa_id) &&
+        id->get_initiator_spi(id) == entry->ike_sa_id->get_initiator_spi(entry->ike_sa_id))
+    {
+        /* this is TRUE for IKE_SAs that we initiated but have not yet received a response */
+        return TRUE;
+    }
+    return FALSE;
+}
+
+/**
+ * Function that matches entry_t objects by ike_sa_t pointers.
+ */
+static bool entry_match_by_sa(entry_t *entry, ike_sa_t *ike_sa)
+{
+    return entry->ike_sa == ike_sa;
+}
+
+/**
+ * Hash function for ike_sa_id_t objects.
+ */
+static u_int ike_sa_id_hash(ike_sa_id_t *ike_sa_id)
+{
+    /* we always use initiator spi as key */
+    return ike_sa_id->get_initiator_spi(ike_sa_id);
+}
+
+typedef struct segment_t segment_t;
+
+/**
+ * Struct to manage segments of the hash table.
+ */
+struct segment_t {
+    /* mutex to access a segment exclusively */
+    mutex_t *mutex;
+    
+    /* the number of items in this segment */
+    u_int count;
+};
-
-typedef struct private_ike_sa_manager_t private_ike_sa_manager_t;
@@ -155 +224 @@
-    
-     /**
-Lock for exclusivly accessing the manager
+Hash table with entries for the ike_sa_t objects
-      */
-mutex_t *mutex
-
+linked_list_t **ike_sa_table
+
-     /**
-Linked list with entries for the ike_sa_t objects
+The size of the hash table
-      */
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-     
-     /**
@@ -180 +269 @@
-};
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
- */
-static status_t get_entry_by_id(private_ike_sa_manager_t *this,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
- */
-static status_t get_entry_by_sa(private_ike_sa_manager_t *this,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
-}
-
-/**
- * Wait until no other thread is using an IKE_SA, return FALSE if entry not
-
-
-
+
+
+
+
-{
-    if (entry->driveout_new_threads)
@@ -312 +557 @@
-         * we register us as waiting. */
-        entry->waiting_threads++;
-
+segments[segment].
-        entry->waiting_threads--;
-    }
@@ -343 +588 @@
-    ike_sa_t *ike_sa = NULL;
-    entry_t *entry;
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
-        {
-            DBG2(DBG_MGR, "IKE_SA successfully checked out");
@@ -356 +600 @@
-            ike_sa = entry->ike_sa;
-        }
-}
-this->mutex->unlock(this->mutex);
+   unlock_single_segment(this, segment);
+}
-    charon->bus->set_sa(charon->bus, ike_sa);
-    return ike_sa;
@@ -369 +613 @@
-    entry_t *entry;
-    ike_sa_id_t *id;
+    u_int segment;
-    
-    if (initiator)
@@ -380 +625 @@
-    entry = entry_create(id);
-    id->destroy(id);
-this->mutex->lock(this->mutex);    
-this->ike_sa_list->insert_last(this->ike_sa_list, entry);
+
+segment = put_entry(this, entry); 
-    entry->checked_out = TRUE;
-this->mutex->unlock(this->mutex);  
-DBG2(DBG_MGR, "created IKE_SA, %d IKE_SAs in manager",
-    this->ike_sa_list->get_count(this->ike_sa_list)
+unlock_single_segment(this, segment);
+
+DBG2(DBG_MGR, "created IKE_SA"
-    return entry->ike_sa;
-}
@@ -395 +640 @@
-                                     message_t *message)
-{
+    u_int segment;
-    entry_t *entry;
-    ike_sa_t *ike_sa = NULL;
@@ -401 +647 @@
-    id->switch_initiator(id);
-    
-
-
+
-    
-    if (message->get_request(message) &&
@@ -408 +653 @@
-    {
-        /* IKE_SA_INIT request. Check for an IKE_SA with such a message hash. */
-        enumerator_t *enumerator;
-        chunk_t data, hash;
-
+   
-        data = message->get_packet_data(message);
-        this->hasher->allocate_hash(this->hasher, data, &hash);
-        chunk_free(&data);
-        
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        
-        if (ike_sa == NULL)
@@ -452 +688 @@
-                entry = entry_create(id);
-                
-
-
+
-                entry->checked_out = TRUE;
-
-
+
+
+
-                entry->init_hash = hash;
-                ike_sa = entry->ike_sa;
+                
+                DBG2(DBG_MGR, "created IKE_SA");
-            }
-            else
@@ -475 +713 @@
-    }
-    
-
-
+
-    {
-        /* only check out if we are not processing this request */
@@ -485 +722 @@
-                 entry->message_id);
-        }
-
+, segment
-        {
-            ike_sa_id_t *ike_id = entry->ike_sa->get_id(entry->ike_sa);
@@ -497 +734 @@
-            ike_sa = entry->ike_sa;
-        }
-}
-this->mutex->unlock(this->mutex);
+   unlock_single_segment(this, segment);
+}
-    id->destroy(id);
-    charon->bus->set_sa(charon->bus, ike_sa);
@@ -516 +753 @@
-    host_t *my_host, *other_host;
-    ike_cfg_t *ike_cfg;
+    u_int segment;
-    
-    ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
@@ -523 +761 @@
-    other_host = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg), 0, 0);
-    
-    this->mutex->lock(this->mutex);
-    
-    if (my_host && other_host && this->reuse_ikesa)
-    {
-this->ike_sa_list->create_enumerator(this->ike_sa_list
-
+create_table_enumerator(this
+, &segment
-        {
-            identification_t *found_my_id, *found_other_id;
-            host_t *found_my_host, *found_other_host;
-        
-
+, segment
-            {
-                continue;
@@ -540 +776 @@
-            if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING)
-            {
- which are not use
+s which are not us
-                continue;
-            }
@@ -586 +822 @@
-    if (!ike_sa)
-    {
-        u_int64_t initiator_spi;
-        entry_t *new_entry;
-        ike_sa_id_t *new_ike_sa_id;
-        
-
-
-
+
-        
-        /* create entry */
-        new_entry = entry_create(new_ike_sa_id);
-        DBG2(DBG_MGR, "created IKE_SA");
-        new_ike_sa_id->destroy(new_ike_sa_id);
-        
-this->ike_sa_list->insert_last(this->ike_sa_list
+segment = put_entry(this
-        
-        /* check ike_sa out */
@@ -605 +837 @@
-        new_entry->checked_out = TRUE;
-        ike_sa = new_entry->ike_sa;
-}
-this->mutex->unlock(this->mutex);
+   unlock_single_segment(this, segment);
+}
-    charon->bus->set_sa(charon->bus, ike_sa);
-    return ike_sa;
@@ -622 +854 @@
-    ike_sa_t *ike_sa = NULL;
-    child_sa_t *child_sa;
-
-
-
-
-
-
-
+
+
+
+
+
+
-        {
-            /* look for a child with such a reqid ... */
@@ -660 +891 @@
-    }
-    enumerator->destroy(enumerator);
-    this->mutex->unlock(this->mutex);
-    
-    charon->bus->set_sa(charon->bus, ike_sa);
@@ -677 +907 @@
-    ike_sa_t *ike_sa = NULL;
-    child_sa_t *child_sa;
-
-
-
-
-
-
-
+
+
+
+
+
+
-        {
-            /* look for a child with such a policy name ... */
@@ -715 +944 @@
-    }
-    enumerator->destroy(enumerator);
-    this->mutex->unlock(this->mutex);
-    
-    charon->bus->set_sa(charon->bus, ike_sa);
@@ -731 +959 @@
-    ike_sa_t *duplicate = NULL;
-    identification_t *me, *other;
+    u_int segment;
-    
-    me = ike_sa->get_my_id(ike_sa);
-    other = ike_sa->get_other_id(ike_sa);
-    
-
-
-
+
+
-    {
-        if (entry->ike_sa == ike_sa)
@@ -749 +977 @@
-             * checkout_duplicate here, as the identities in entry would not
-             * have been set yet. Otherwise we would risk a deadlock. */
-
+, segment
-            {
-                duplicate = entry->ike_sa;
@@ -758 +986 @@
-    }
-    enumerator->destroy(enumerator);
-    this->mutex->unlock(this->mutex);
-    return duplicate;
-}
-
-/**
- * enumerator cleanup function
- */
-static void enumerator_unlock(private_ike_sa_manager_t *this)
-{
-    this->mutex->unlock(this->mutex);
-}
-
-/**
- * enumerator filter function 
- */
-static bool enumerator_filter(private_ike_sa_manager_t *this,
-
-
-
+, u_int *segment
+
+, *segment
-    {
-        *out = (*in)->ike_sa;
@@ -785 +1004 @@
-
-/**
-it
+enum
- */
-static enumerator_t *create_enumerator(private_ike_sa_manager_t* this)
-{
-    this->mutex->lock(this->mutex);
-    return enumerator_create_filter(
-this->ike_sa_list->create_enumerator(this->ike_sa_list
-(void*)enumerator_unlock
+create_table_enumerator(this
+NULL
-}
-
@@ -802 +1020 @@
-    /* to check the SA back in, we look for the pointer of the ike_sa
-     * in all entries.
-
-
+
+
+
-     */
-    status_t retval;
@@ -810 +1029 @@
-    host_t *other;
-    identification_t *my_id, *other_id;
+    u_int segment;
-    
-    ike_sa_id = ike_sa->get_id(ike_sa);
@@ -815 +1035 @@
-    DBG2(DBG_MGR, "checkin IKE_SA");
-    
-    this->mutex->lock(this->mutex);
-
-    /* look for the entry */
-, &entry
+_id, ike_sa, &entry, &segment
-    {
-        /* ike_sa_id must be updated */
@@ -832 +1050 @@
-            entry->other = other->clone(other);
-        }
-i
+u
-        my_id = ike_sa->get_my_id(ike_sa);
-        other_id = ike_sa->get_other_id(ike_sa);
@@ -850 +1068 @@
-        entry->condvar->signal(entry->condvar);
-        retval = SUCCESS;
+        unlock_single_segment(this, segment);
-    }
-    else
@@ -858 +1077 @@
-    }
-    
-    DBG2(DBG_MGR, "%d IKE_SAs in manager now",
-         this->ike_sa_list->get_count(this->ike_sa_list));
-    this->mutex->unlock(this->mutex);
-    
-    charon->bus->set_sa(charon->bus, NULL);
-    return retval;
@@ -872 +1087 @@
-static status_t checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
-{
-garant
+ensure
-     * this SA.
-list
+table
-     * are in the condvar.
-     */
@@ -880 +1095 @@
-    status_t retval;
-    ike_sa_id_t *ike_sa_id;
+    u_int segment;
-    
-    ike_sa_id = ike_sa->get_id(ike_sa);
+    
-    DBG2(DBG_MGR, "checkin and destroy IKE_SA");
-
-
-
-
+
-    {
-        /* drive out waiting threads, as we are in hurry */
-        entry->driveout_waiting_threads = TRUE;
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        
-        DBG2(DBG_MGR, "check-in and destroy of IKE_SA successful");
@@ -902 +1129 @@
-    }
-    charon->bus->set_sa(charon->bus, NULL);
-    
-    this->mutex->unlock(this->mutex);
-    return retval;
-}
@@ -916 +1141 @@
-    int count = 0;
-
-
-
+
-    while (enumerator->enumerate(enumerator, &entry))
-    {
@@ -940 +1164 @@
-    enumerator->destroy(enumerator);
-    
-    this->mutex->unlock(this->mutex);
-    return count;
-}
@@ -952 +1175 @@
-    enumerator_t *enumerator;
-    entry_t *entry;
-
-
+
+
+
-    DBG2(DBG_MGR, "going to destroy IKE_SA manager and all managed IKE_SA's");
-    /* Step 1: drive out all waiting threads  */
-    DBG2(DBG_MGR, "set driveout flags for all stored IKE_SA's");
-this->ike_sa_list->create_enumerator(this->ike_sa_list
-
+create_table_enumerator(this
+, &segment
-    {
-        /* do not accept new threads, drive out waiting threads */
@@ -967 +1191 @@
-    DBG2(DBG_MGR, "wait for all threads to leave IKE_SA's");
-    /* Step 2: wait until all are gone */
-this->ike_sa_list->create_enumerator(this->ike_sa_list
-
+create_table_enumerator(this
+, &segment
-    {
-        while (entry->waiting_threads)
@@ -975 +1199 @@
-            entry->condvar->broadcast(entry->condvar);
-            /* go sleeping until they are gone */
-
+segments[segment].
-        }
-    }
@@ -981 +1205 @@
-    DBG2(DBG_MGR, "delete all IKE_SA's");
-    /* Step 3: initiate deletion of all IKE_SAs */
-this->ike_sa_list->create_enumerator(this->ike_sa_list
-
+create_table_enumerator(this
+, &segment
-    {
-        charon->bus->set_sa(charon->bus, entry->ike_sa);
@@ -991 +1215 @@
-    DBG2(DBG_MGR, "destroy all entries");
-    /* Step 4: destroy all entries */
-while (this->ike_sa_list->remove_last(this->ike_sa_list,
-                                     (void**)&entry) == SUCCESS
+enumerator = create_table_enumerator(this);
+while (enumerator->enumerate(enumerator, &entry, &segment)
-    {
-        charon->bus->set_sa(charon->bus, entry->ike_sa);
+        remove_entry_at((private_enumerator_t*)enumerator);
-        entry_destroy(entry);
-    }
+    enumerator->destroy(enumerator);
-    charon->bus->set_sa(charon->bus, NULL);
-this->mutex->unlock(this->mutex
+unlock_all_segments(this
-}
-
@@ -1006 +1232 @@
-static void destroy(private_ike_sa_manager_t *this)
-{
-
+
+
+
+
+
+
+
+
+
+
+
+