denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactored IMV policy management

Browse Source
This commit is contained in:
Andreas Steffen
2013-06-21 23:25:22 +02:00
parent 4f9aabbfd7
commit a6266485be
23 changed files with 889 additions and 600 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/imv/imv_database.c
+115 -105
View File
@@ -21,19 +21,14 @@
#include <time.h>
#include "imv_database.h"
#include "imv_workitem.h"
#include <utils/debug.h>
#include <threading/mutex.h>
typedef struct private_imv_database_t private_imv_database_t;
#define SESSION_TIME_DELTA_MAX 2 /* seconds */
#define DEFAULT_POLICY_SCRIPT "ipsec _imv_policy"
/**
* Private data of a imv_database_t object.
*
*/
struct private_imv_database_t {
@@ -52,34 +47,46 @@ struct private_imv_database_t {
*/
char *script;
/**
* Session list
*/
linked_list_t *sessions;
/**
* mutex used to lock session list
*/
mutex_t *mutex;
};
METHOD(imv_database_t, get_session_id, int,
private_imv_database_t *this, TNC_ConnectionID id, u_int32_t ar_id_type,
chunk_t ar_id_value)
METHOD(imv_database_t, get_session, imv_session_t*,
private_imv_database_t *this, TNC_ConnectionID conn_id,
u_int32_t ar_id_type, chunk_t ar_id_value)
{
enumerator_t *e;
int ar_id = 0, session_id = 0;
enumerator_t *enumerator, *e;
imv_session_t *current, *session = NULL;
int ar_id = 0, session_id;
u_int created;
time_t now;
/* get most recent session for a given connection ID if available */
e = this->db->query(this->db,
"SELECT id, time FROM sessions WHERE connection = ? "
"ORDER BY time DESC", DB_INT, id, DB_INT, DB_UINT);
if (e)
this->mutex->lock(this->mutex);
/* check if a session has already been assigned */
enumerator = this->sessions->create_enumerator(this->sessions);
while (enumerator->enumerate(enumerator, &current))
{
e->enumerate(e, &session_id, &created);
e->destroy(e);
if (conn_id == current->get_connection_id(current))
{
session = current;
break;
}
}
enumerator->destroy(enumerator);
/* get current time */
now = time(NULL);
/* check if a new session has already been created by another IMV */
if (session_id && (now - created) <= SESSION_TIME_DELTA_MAX)
/* session already exists */
if (session)
{
return session_id;
this->mutex->unlock(this->mutex);
return session->get_ref(session);
}
if (ar_id_value.len)
@@ -102,17 +109,22 @@ METHOD(imv_database_t, get_session_id, int,
DB_INT, ar_id_type, DB_BLOB, ar_id_value);
}
}
/* create a new session ID */
/* create a new session entry */
created = time(NULL);
this->db->execute(this->db, &session_id,
"INSERT INTO sessions (time, connection, identity) "
"VALUES (?, ?, ?)", DB_UINT, now, DB_INT, id, DB_INT, ar_id);
"INSERT INTO sessions (time, connection, identity) "
"VALUES (?, ?, ?)",
DB_UINT, created, DB_INT, conn_id, DB_INT, ar_id);
session = imv_session_create(session_id, conn_id);
this->sessions->insert_last(this->sessions, session);
return session_id;
this->mutex->unlock(this->mutex);
return session;
}
METHOD(imv_database_t, add_product, int,
private_imv_database_t *this, int session_id, char *product)
private_imv_database_t *this, imv_session_t *session, char *product)
{
enumerator_t *e;
int pid = 0;
@@ -138,14 +150,14 @@ METHOD(imv_database_t, add_product, int,
{
this->db->execute(this->db, NULL,
"UPDATE sessions SET product = ? WHERE id = ?",
DB_INT, pid, DB_INT, session_id);
DB_INT, pid, DB_INT, session->get_session_id(session));
}
return pid;
}
METHOD(imv_database_t, add_device, int,
private_imv_database_t *this, int session_id, chunk_t device)
private_imv_database_t *this, imv_session_t *session, chunk_t device)
{
enumerator_t *e;
int did = 0;
@@ -171,18 +183,25 @@ METHOD(imv_database_t, add_device, int,
{
this->db->execute(this->db, NULL,
"UPDATE sessions SET device = ? WHERE id = ?",
DB_INT, did, DB_INT, session_id);
DB_INT, did, DB_INT, session->get_session_id(session));
}
return did;
}
METHOD(imv_database_t, policy_script, bool,
private_imv_database_t *this, int session_id, bool start)
private_imv_database_t *this, imv_session_t *session, bool start)
{
char command[512], resp[128], *last;
imv_workitem_t *workitem;
imv_workitem_type_t type;
imv_session_t *current;
int id, session_id, rec_fail, rec_noresult;
enumerator_t *enumerator, *e;
char command[512], resp[128], *last, *argument;
FILE *shell;
session_id = session->get_session_id(session);
snprintf(command, sizeof(command), "2>&1 TNC_SESSION_ID='%d' %s %s",
session_id, this->script, start ? "start" : "stop");
DBG3(DBG_IMV, "running policy script: %s", command);
@@ -217,75 +236,62 @@ METHOD(imv_database_t, policy_script, bool,
}
pclose(shell);
if (start && !session->get_policy_started(session))
{
/* get workitem list generated by policy manager */
e = this->db->query(this->db,
"SELECT id, type, argument, rec_fail, rec_noresult "
"FROM workitems WHERE session = ?",
DB_INT, session_id, DB_INT, DB_INT, DB_TEXT, DB_INT, DB_INT);
if (!e)
{
DBG1(DBG_IMV, "no workitem enumerator returned");
return FALSE;
}
while (e->enumerate(e, &id, &type, &argument, &rec_fail, &rec_noresult))
{
workitem = imv_workitem_create(id, type, argument, rec_fail,
rec_noresult);
session->insert_workitem(session, workitem);
}
e->destroy(e);
session->set_policy_started(session, TRUE);
}
else if (!start && session->get_policy_started(session))
{
/* remove session */
this->mutex->lock(this->mutex);
enumerator = this->sessions->create_enumerator(this->sessions);
while (enumerator->enumerate(enumerator, &current))
{
if (current == session)
{
this->sessions->remove_at(this->sessions, enumerator);
break;
}
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
session->set_policy_started(session, FALSE);
}
return TRUE;
}
typedef struct {
/** implements enumerator_t */
enumerator_t public;
/** session ID */
int session_id;
/** database enumerator */
enumerator_t *e;
} workitem_enumerator_t;
/**
* Implementation of enumerator.enumerate
*/
static bool workitem_enumerator_enumerate(workitem_enumerator_t *this, ...)
METHOD(imv_database_t, finalize_workitem, bool,
private_imv_database_t *this, imv_workitem_t *workitem)
{
imv_workitem_t **workitem;
imv_workitem_type_t type;
int rec_fail, rec_noresult;
char *argument;
va_list args;
char *result;
int rec;
va_start(args, this);
workitem = va_arg(args, imv_workitem_t**);
va_end(args);
rec = workitem->get_result(workitem, &result);
if (this->e->enumerate(this->e, &type, &argument, &rec_fail, &rec_noresult))
{
*workitem = imv_workitem_create(this->session_id, type, argument,
rec_fail, rec_noresult);
return TRUE;
}
return FALSE;
}
/**
* Implementation of enumerator.destroy
*/
static void workitem_enumerator_destroy(workitem_enumerator_t *this)
{
this->e->destroy(this->e);
free(this);
}
METHOD(imv_database_t, create_workitem_enumerator, enumerator_t*,
private_imv_database_t *this, int session_id)
{
workitem_enumerator_t *enumerator;
enumerator_t *e;
e = this->db->query(this->db,
"SELECT type, argument, rec_fail, rec_noresult "
"FROM workitems WHERE session = ?",
DB_INT, session_id, DB_INT, DB_TEXT, DB_INT, DB_INT);
if (!e)
{
return NULL;
}
INIT(enumerator,
.public = {
.enumerate = (void*)workitem_enumerator_enumerate,
.destroy = (void*)workitem_enumerator_destroy,
},
.e = e,
);
return (enumerator_t*)enumerator;
return this->db->execute(this->db, NULL,
"UPDATE workitems SET result = ?, rec_final = ? WHERE id = ?",
DB_TEXT, result, DB_INT, rec,
DB_INT, workitem->get_id(workitem)) == 1;
}
METHOD(imv_database_t, get_database, database_t*,
@@ -298,36 +304,40 @@ METHOD(imv_database_t, destroy, void,
private_imv_database_t *this)
{
this->db->destroy(this->db);
this->sessions->destroy_offset(this->sessions,
offsetof(imv_session_t, destroy));
this->mutex->destroy(this->mutex);
free(this);
}
/**
* See header
*/
imv_database_t *imv_database_create(char *uri)
imv_database_t *imv_database_create(char *uri, char *script)
{
private_imv_database_t *this;
INIT(this,
.public = {
.get_session_id = _get_session_id,
.get_session = _get_session,
.add_product = _add_product,
.add_device = _add_device,
.policy_script = _policy_script,
.create_workitem_enumerator = _create_workitem_enumerator,
.finalize_workitem = _finalize_workitem,
.get_database = _get_database,
.destroy = _destroy,
},
.db = lib->db->create(lib->db, uri),
.script = lib->settings->get_str(lib->settings,
"libimcv.policy_script", DEFAULT_POLICY_SCRIPT),
.script = script,
.sessions = linked_list_create(),
.mutex = mutex_create(MUTEX_TYPE_DEFAULT),
);
if (!this->db)
{
DBG1(DBG_IMV,
"failed to connect to IMV database '%s'", uri);
free(this);
destroy(this);
return NULL;
}