- New upstream release.

1 files changed, 161 insertions, 147 deletions

diff --git a/src/charon/plugins/sql/sql_attribute.c b/src/charon/plugins/sql/sql_attribute.c
index 45c0750c7..1e5c28966 100644
--- a/src/charon/plugins/sql/sql_attribute.c
+++ b/src/charon/plugins/sql/sql_attribute.c
@@ -18,7 +18,6 @@
 #include "sql_attribute.h"
 
 #include <daemon.h>
-#include <utils/mutex.h>
 
 typedef struct private_sql_attribute_t private_sql_attribute_t;
 
@@ -38,185 +37,155 @@ struct private_sql_attribute_t {
 	database_t *db;
 	
 	/**
-	 * mutex to simulate transactions
+	 * wheter to record lease history in lease table
 	 */
-	mutex_t *mutex;
+	bool history;
 };
 
-/** 
- * convert a address blob to an ip of the correct family
+/**
+ * read a host_t address from the addresses table
  */
-static host_t *ip_from_chunk(chunk_t address)
+static host_t *host_from_chunk(chunk_t chunk)
 {
-	switch (address.len)
+	switch (chunk.len)
 	{
 		case 4:
-			return host_create_from_chunk(AF_INET, address, 0);
+			return host_create_from_chunk(AF_INET, chunk, 0);
 		case 16:
-			return host_create_from_chunk(AF_INET6, address, 0);
+			return host_create_from_chunk(AF_INET6, chunk, 0);
 		default:
 			return NULL;
-	}		
+	}
 }
 
 /**
- * increment a chunk, as it would reprensent a network order integer
+ * lookup/insert an identity
  */
-static void increment_chunk(chunk_t chunk)
+static u_int get_identity(private_sql_attribute_t *this, identification_t *id)
 {
-	int i;
+	enumerator_t *e;
+	u_int row;
 	
-	for (i = chunk.len - 1; i >= 0; i++)
+	/* look for peer identity in the identities table */
+	e = this->db->query(this->db,
+						"SELECT id FROM identities WHERE type = ? AND data = ?",
+						DB_INT, id->get_type(id), DB_BLOB, id->get_encoding(id),
+						DB_UINT);
+						
+	if (e && e->enumerate(e, &row))
 	{
-		if (++chunk.ptr[i] != 0)
-		{
-			return;
-		}
+		e->destroy(e);
+		return row;
+	}
+	DESTROY_IF(e);
+	/* not found, insert new one */
+	if (this->db->execute(this->db, &row,
+				  "INSERT INTO identities (type, data) VALUES (?, ?)",
+				  DB_INT, id->get_type(id), DB_BLOB, id->get_encoding(id)) == 1)
+	{
+		return row;
 	}
+	return 0;
 }
 
 /**
- * Lookup if we have an existing lease
+ * Lookup pool by name
  */
-static host_t* get_lease(private_sql_attribute_t *this,
-						 char *name, identification_t *id)
+static u_int get_pool(private_sql_attribute_t *this, char *name, u_int *timeout)
 {
 	enumerator_t *e;
-	chunk_t address;
-	host_t *ip = NULL;
-	int lease;
-	
-	/* transaction simulation, see create_lease() */
-	this->mutex->lock(this->mutex);
-	
-	/* select a lease for "id" which still valid */
-	e = this->db->query(this->db,
-						"SELECT l.id, l.address FROM leases AS l "
-						"JOIN pools AS p ON l.pool = p.id "
-						"JOIN identities AS i ON l.identity = i.id "
-						"WHERE p.name = ? AND i.type = ? AND i.data = ? "
-						"AND (l.released IS NULL OR p.timeout = 0 "
-						" OR (l.released >= (? - p.timeout))) "
-						"ORDER BY l.acquired LIMIT 1", DB_TEXT, name,
-						DB_INT, id->get_type(id), DB_BLOB, id->get_encoding(id),
-						DB_UINT, time(NULL),
-						DB_UINT, DB_BLOB);
-	if (e)
+	u_int pool;
+
+	e = this->db->query(this->db, "SELECT id, timeout FROM pools WHERE name = ?",
+						DB_TEXT, name, DB_UINT, DB_UINT);
+	if (e && e->enumerate(e, &pool, timeout))
 	{
-		if (e->enumerate(e, &lease, &address))
-		{
-			/* found one, set the lease to active */
-			if (this->db->execute(this->db, NULL,
-						  "UPDATE leases SET released = NULL WHERE id = ?",
-						  DB_UINT, lease) > 0)
-			{
-				ip = ip_from_chunk(address);
-				DBG1(DBG_CFG, "reassigning address from valid lease "
-					 "from pool '%s'", name);
-			}
-		}
 		e->destroy(e);
+		return pool;
 	}
-	this->mutex->unlock(this->mutex);
-	return ip;
+	DBG1(DBG_CFG, "ip pool '%s' not found");
+	return 0;
 }
 
 /**
- * Create a new lease entry for client
+ * Lookup a lease
  */
-static host_t* create_lease(private_sql_attribute_t *this,
-							char *name, identification_t *id)
+static host_t *get_address(private_sql_attribute_t *this, char *name,
+						   u_int pool, u_int timeout, u_int identity)
 {
 	enumerator_t *e;
+	u_int id;
 	chunk_t address;
-	host_t *ip = NULL;
-	u_int pool, identity = 0, released, timeout;
-	bool new = FALSE;
+	host_t *host;
+	time_t now = time(NULL);
 	
-	/* we currently do not use database transactions. While this would be 
-	 * the clean way, there is no real advantage, but some disadvantages:
-	 * - we would require InnoDB for mysql, as MyISAM does not support trans.
-	 * - the mysql plugin uses connection pooling, and we would need a 
-	 *   mechanism to lock transactions to a single connection.
-	 */
-	this->mutex->lock(this->mutex);
+	/* We check for leases for that identity first and for other expired
+	 * leases afterwards. We select an address as a candidate, but double
+	 * check if it is still valid in the update. This allows us to work
+	 * without locking. */
 	
-	/* find an address which has outdated leases only. The HAVING clause filters
-	 * out leases which are active (released = NULL) or not expired */
-	e = this->db->query(this->db,
-						"SELECT pool, address, released, timeout FROM leases "
-						"JOIN pools ON leases.pool = pools.id "
-						"WHERE name = ? and timeout > 0 "
-						"GROUP BY address HAVING COUNT(released) = COUNT(*) "
-						"AND MAX(released) < (? - timeout) LIMIT 1",
-						DB_TEXT, name, DB_UINT, time(NULL),
-						DB_UINT, DB_BLOB, DB_UINT, DB_UINT);
-	
-	if (!e || !e->enumerate(e, &pool, &address, &released, &timeout))
+	/* check for an existing lease for that identity  */
+	while (TRUE)
 	{
-		DESTROY_IF(e);
-		/* no outdated lease found, acquire new address */
 		e = this->db->query(this->db,
-				"SELECT id, next FROM pools WHERE name = ? AND next <= end",
-				DB_TEXT, name,
-				DB_UINT, DB_BLOB);
-		if (!e || !e->enumerate(e, &pool, &address))
+				"SELECT id, address FROM addresses "
+				"WHERE pool = ? AND identity = ? AND released != 0 LIMIT 1",
+				DB_UINT, pool, DB_UINT, identity, DB_UINT, DB_BLOB);
+		if (!e || !e->enumerate(e, &id, &address))
 		{
-			/* pool seems full */
 			DESTROY_IF(e);
-			this->mutex->unlock(this->mutex);
-			return NULL;
+			break;	
+		}
+		address = chunk_clonea(address);
+		e->destroy(e);
+		if (this->db->execute(this->db, NULL,
+				"UPDATE addresses SET acquired = ?, released = 0 "
+				"WHERE id = ? AND identity = ? AND released != 0",
+				DB_UINT, now, DB_UINT, id, DB_UINT, identity) > 0)
+		{
+			host = host_from_chunk(address);
+			if (host)
+			{
+				DBG1(DBG_CFG, "acquired existing lease "
+					 "for address %H in pool '%s'", host, name);
+				return host;
+			}
 		}
-		new = TRUE;
 	}
-	address = chunk_clonea(address);
-	e->destroy(e);
 	
-	/* look for peer identity in the identities table */
-	e = this->db->query(this->db,
-						"SELECT id FROM identities WHERE type = ? AND data = ?",
-						DB_INT, id->get_type(id), DB_BLOB, id->get_encoding(id),
-						DB_UINT);
-	if (!e || !e->enumerate(e, &identity))
-	{
-		DESTROY_IF(e);
-		/* not found, insert new one */
-		this->db->execute(this->db, &identity,
-					  "INSERT INTO identities (type, data) VALUES (?, ?)",
-					  DB_INT, id->get_type(id), DB_BLOB, id->get_encoding(id));
-	}
-	else
+	/* check for an expired lease */
+	while (TRUE)
 	{
+		e = this->db->query(this->db,
+				"SELECT id, address FROM addresses "
+				"WHERE pool = ? AND released != 0 AND released < ? LIMIT 1",
+				DB_UINT, pool, DB_UINT, now - timeout, DB_UINT, DB_BLOB);
+		if (!e || !e->enumerate(e, &id, &address))
+		{
+			DESTROY_IF(e);
+			break;	
+		}
+		address = chunk_clonea(address);
 		e->destroy(e);
-	}
-	/* if we have an identity, insert a new lease */
-	if (identity)
-	{
+			
 		if (this->db->execute(this->db, NULL,
-				"INSERT INTO leases (pool, address, identity, acquired) "
-				"VALUES (?, ?, ?, ?)",
-				DB_UINT, pool, DB_BLOB, address, DB_UINT, identity,
-				DB_UINT, time(NULL)) > 0)
+				"UPDATE addresses SET "
+				"acquired = ?, released = 0, identity = ? "
+				"WHERE id = ? AND released != 0 AND released < ?",
+				DB_UINT, now, DB_UINT, identity,
+				DB_UINT, id, DB_UINT, now - timeout) > 0)
 		{
-			ip = ip_from_chunk(address);
-			if (new)
-			{	/* update next address, as we have consumed one */
-				increment_chunk(address);
-				this->db->execute(this->db, NULL,
-								  "UPDATE pools SET next = ? WHERE id = ?",
-								  DB_BLOB, address, DB_UINT, pool);
-				DBG1(DBG_CFG, "assigning lease with new address "
-					 "from pool '%s'", name);
-			}
-			else
+			host = host_from_chunk(address);
+			if (host)
 			{
-				DBG1(DBG_CFG, "reassigning address from expired lease "
-					 "from pool '%s'", name);
+				DBG1(DBG_CFG, "acquired new lease "
+					 "for address %H in pool '%s'", host, name);
+				return host;
 			}
 		}
 	}
-	this->mutex->unlock(this->mutex);
-	return ip;
+	DBG1(DBG_CFG, "no available address found in pool '%s'", name);
+	return 0;
 }
 
 /**
@@ -226,14 +195,29 @@ static host_t* acquire_address(private_sql_attribute_t *this,
 							   char *name, identification_t *id,
 							   auth_info_t *auth, host_t *requested)
 {
-	host_t *ip;
+	enumerator_t *enumerator;
+	u_int pool, timeout, identity;
+	host_t *address = NULL;
 	
-	ip = get_lease(this, name, id);
-	if (!ip)
+	identity = get_identity(this, id);
+	if (identity)
 	{
-		ip = create_lease(this, name, id);
+		enumerator = enumerator_create_token(name, ",", " ");
+		while (enumerator->enumerate(enumerator, &name))
+		{
+			pool = get_pool(this, name, &timeout);
+			if (pool)
+			{
+				address = get_address(this, name, pool, timeout, identity);
+				if (address)
+				{
+					break;
+				}
+			}
+		}
+		enumerator->destroy(enumerator);
 	}
-	return ip;
+	return address;
 }
 
 /**
@@ -242,16 +226,39 @@ static host_t* acquire_address(private_sql_attribute_t *this,
 static bool release_address(private_sql_attribute_t *this,
 							char *name, host_t *address)
 {
-	if (this->db->execute(this->db, NULL,
-			"UPDATE leases SET released = ? WHERE "
-			"pool IN (SELECT id FROM pools WHERE name = ?) AND "
-			"address = ? AND released IS NULL",
-			DB_UINT, time(NULL),
-			DB_TEXT, name, DB_BLOB, address->get_address(address)) > 0)
+	enumerator_t *enumerator;
+	bool found = FALSE;
+	time_t now = time(NULL);
+	
+	enumerator = enumerator_create_token(name, ",", " ");
+	while (enumerator->enumerate(enumerator, &name))
 	{
-		return TRUE;
+		u_int pool, timeout;
+		
+		pool = get_pool(this, name, &timeout);
+		if (pool)
+		{
+			if (this->history)
+			{
+				this->db->execute(this->db, NULL,
+					"INSERT INTO leases (address, identity, acquired, released)"
+					" SELECT id, identity, acquired, ? FROM addresses "
+					" WHERE pool = ? AND address = ?",
+					DB_UINT, now, DB_UINT, pool,
+					DB_BLOB, address->get_address(address));
+			}
+			if (this->db->execute(this->db, NULL,
+					"UPDATE addresses SET released = ? WHERE "
+					"pool = ? AND address = ?", DB_UINT, time(NULL),
+					DB_UINT, pool, DB_BLOB, address->get_address(address)) > 0)
+			{
+				found = TRUE;
+				break;
+			}
+		}
 	}
-	return FALSE;
+	enumerator->destroy(enumerator);
+	return found;
 }
 
 /**
@@ -259,7 +266,6 @@ static bool release_address(private_sql_attribute_t *this,
  */
 static void destroy(private_sql_attribute_t *this)
 {
-	this->mutex->destroy(this->mutex);
 	free(this);
 }
 
@@ -269,19 +275,27 @@ static void destroy(private_sql_attribute_t *this)
 sql_attribute_t *sql_attribute_create(database_t *db)
 {
 	private_sql_attribute_t *this = malloc_thing(private_sql_attribute_t);
+	time_t now = time(NULL);
 	
 	this->public.provider.acquire_address = (host_t*(*)(attribute_provider_t *this, char*, identification_t *,auth_info_t *, host_t *))acquire_address;
 	this->public.provider.release_address = (bool(*)(attribute_provider_t *this, char*,host_t *))release_address;
 	this->public.destroy = (void(*)(sql_attribute_t*))destroy;
 	
 	this->db = db;
-	this->mutex = mutex_create(MUTEX_DEFAULT);
+	this->history = lib->settings->get_bool(lib->settings,
+									"charon.plugins.sql.lease_history", TRUE);
 	
 	/* close any "online" leases in the case we crashed */
+	if (this->history)
+	{
+		this->db->execute(this->db, NULL,
+					"INSERT INTO leases (address, identity, acquired, released)"
+					" SELECT id, identity, acquired, ? FROM addresses "
+					" WHERE released = 0", DB_UINT, now);
+	}
 	this->db->execute(this->db, NULL,
-					  "UPDATE leases SET released = ? WHERE released IS NULL",
-					  DB_UINT, time(NULL));
-	
+					  "UPDATE addresses SET released = ? WHERE released = 0",
+					  DB_UINT, now);
 	return &this->public;
 }