src/charon/sa/ike_sa.h

   1 /**
   2  * @file ike_sa.h
   3  *
   4  * @brief Interface of ike_sa_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
  10  * Copyright (C) 2005-2006 Martin Willi
  11  * Copyright (C) 2005 Jan Hutter
  12  * Hochschule fuer Technik Rapperswil
  13  *
  14  * This program is free software; you can redistribute it and/or modify it
  15  * under the terms of the GNU General Public License as published by the
  16  * Free Software Foundation; either version 2 of the License, or (at your
  17  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  18  *
  19  * This program is distributed in the hope that it will be useful, but
  20  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  21  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  22  * for more details.
  23  */
  24
  25 #ifndef IKE_SA_H_
  26 #define IKE_SA_H_
  27
  28 typedef enum ike_extension_t ike_extension_t;
  29 typedef enum ike_sa_state_t ike_sa_state_t;
  30 typedef struct ike_sa_t ike_sa_t;
  31
  32 #include <library.h>
  33 #include <encoding/message.h>
  34 #include <encoding/payloads/proposal_substructure.h>
  35 #include <sa/ike_sa_id.h>
  36 #include <sa/child_sa.h>
  37 #include <sa/tasks/task.h>
  38 #include <utils/randomizer.h>
  39 #include <crypto/prfs/prf.h>
  40 #include <crypto/crypters/crypter.h>
  41 #include <crypto/signers/signer.h>
  42 #include <crypto/ca.h>
  43 #include <config/peer_cfg.h>
  44 #include <config/ike_cfg.h>
  45
  46 /**
  47  * Timeout in milliseconds after that a half open IKE_SA gets deleted.
  48  *
  49  * @ingroup sa
  50  */
  51 #define HALF_OPEN_IKE_SA_TIMEOUT 30000
  52
  53 /**
  54  * Interval to send keepalives when NATed, in seconds.
  55  *
  56  * @ingroup sa
  57  */
  58 #define KEEPALIVE_INTERVAL 20
  59
  60 /**
  61  * After which time rekeying should be retried if it failed, in seconds.
  62  *
  63  * @ingroup sa
  64  */
  65 #define RETRY_INTERVAL 30
  66
  67 /**
  68  * Jitter to subtract from RETRY_INTERVAL to randomize rekey retry.
  69  *
  70  * @ingroup sa
  71  */
  72 #define RETRY_JITTER 20
  73
  74 /**
  75  * @brief Extensions (or optional features) the peer supports
  76  */
  77 enum ike_extension_t {
  78
  79         /**
  80          * peer supports NAT traversal as specified in RFC4306
  81          */
  82         EXT_NATT,
  83
  84         /**
  85          * peer supports MOBIKE (RFC4555)
  86          */
  87         EXT_MOBIKE,
  88 };
  89
  90 /**
  91  * @brief State of an IKE_SA.
  92  *
  93  * An IKE_SA passes various states in its lifetime. A newly created
  94  * SA is in the state CREATED.
  95  * @verbatim
  96                  +----------------+
  97                  ¦   SA_CREATED   ¦
  98                  +----------------+
  99                          ¦
 100     on initiate()--->    ¦   <----- on IKE_SA_INIT received
 101                          V
 102                  +----------------+
 103                  ¦ SA_CONNECTING  ¦
 104                  +----------------+
 105                          ¦
 106                          ¦   <----- on IKE_AUTH successfully completed
 107                          V
 108                  +----------------+
 109                  ¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
 110                  +----------------+                         ¦
 111                          ¦                                  V
 112     on delete()--->      ¦   <----- on IKE_SA        +-------------+
 113                          ¦          delete request   ¦ SA_REKEYING ¦
 114                          ¦          received         +-------------+
 115                          V                                  ¦
 116                  +----------------+                         ¦
 117                  ¦  SA_DELETING   ¦<------------------------+ <-- after rekeying
 118                  +----------------+
 119                          ¦
 120                          ¦   <----- after delete() acknowledged
 121                          ¦
 122                         \V/
 123                          X
 124                         / \
 125    @endverbatim
 126  *
 127  * @ingroup sa
 128  */
 129 enum ike_sa_state_t {
 130
 131         /**
 132          * IKE_SA just got created, but is not initiating nor responding yet.
 133          */
 134         IKE_CREATED,
 135
 136         /**
 137          * IKE_SA gets initiated actively or passively
 138          */
 139         IKE_CONNECTING,
 140
 141         /**
 142          * IKE_SA is fully established
 143          */
 144         IKE_ESTABLISHED,
 145
 146         /**
 147          * IKE_SA rekeying in progress
 148          */
 149         IKE_REKEYING,
 150
 151         /**
 152          * IKE_SA is in progress of deletion
 153          */
 154         IKE_DELETING,
 155 };
 156
 157 /**
 158  * enum names for ike_sa_state_t.
 159  */
 160 extern enum_name_t *ike_sa_state_names;
 161
 162 /**
 163  * @brief Class ike_sa_t representing an IKE_SA.
 164  *
 165  * An IKE_SA contains crypto information related to a connection
 166  * with a peer. It contains multiple IPsec CHILD_SA, for which
 167  * it is responsible. All traffic is handled by an IKE_SA, using
 168  * the task manager and its tasks.
 169  *
 170  * @b Constructors:
 171  * - ike_sa_create()
 172  *
 173  * @ingroup sa
 174  */
 175 struct ike_sa_t {
 176
 177         /**
 178          * @brief Get the id of the SA.
 179          *
 180          * Returned ike_sa_id_t object is not getting cloned!
 181          *
 182          * @param this                  calling object
 183          * @return                              ike_sa's ike_sa_id_t
 184          */
 185         ike_sa_id_t* (*get_id) (ike_sa_t *this);
 186
 187         /**
 188          * @brief Get the numerical ID uniquely defining this IKE_SA.
 189          *
 190          * @param this                  calling object
 191          * @return                              unique ID
 192          */
 193         u_int32_t (*get_unique_id) (ike_sa_t *this);
 194
 195         /**
 196          * @brief Get the state of the IKE_SA.
 197          *
 198          * @param this                  calling object
 199          * @return                              state of the IKE_SA
 200          */
 201         ike_sa_state_t (*get_state) (ike_sa_t *this);
 202
 203         /**
 204          * @brief Get some statistics about this IKE_SA.
 205          *
 206          * @param next_rekeying                 when the next rekeying is scheduled
 207          */
 208         void (*get_stats)(ike_sa_t *this, u_int32_t *next_rekeying);
 209
 210         /**
 211          * @brief Set the state of the IKE_SA.
 212          *
 213          * @param this                  calling object
 214          * @param state                 state to set for the IKE_SA
 215          */
 216         void (*set_state) (ike_sa_t *this, ike_sa_state_t ike_sa);
 217
 218         /**
 219          * @brief Get the name of the connection this IKE_SA uses.
 220          *
 221          * @param this                  calling object
 222          * @return                              name
 223          */
 224         char* (*get_name) (ike_sa_t *this);
 225
 226         /**
 227          * @brief Get the own host address.
 228          *
 229          * @param this                  calling object
 230          * @return                              host address
 231          */
 232         host_t* (*get_my_host) (ike_sa_t *this);
 233
 234         /**
 235          * @brief Set the own host address.
 236          *
 237          * @param this                  calling object
 238          * @param me                    host address
 239          */
 240         void (*set_my_host) (ike_sa_t *this, host_t *me);
 241
 242         /**
 243          * @brief Get the other peers host address.
 244          *
 245          * @param this                  calling object
 246          * @return                              host address
 247          */
 248         host_t* (*get_other_host) (ike_sa_t *this);
 249
 250         /**
 251          * @brief Set the others host address.
 252          *
 253          * @param this                  calling object
 254          * @param other                 host address
 255          */
 256         void (*set_other_host) (ike_sa_t *this, host_t *other);
 257
 258         /**
 259          * @brief Get the own identification.
 260          *
 261          * @param this                  calling object
 262          * @return                              identification
 263          */
 264         identification_t* (*get_my_id) (ike_sa_t *this);
 265
 266         /**
 267          * @brief Set the own identification.
 268          *
 269          * @param this                  calling object
 270          * @param me                    identification
 271          */
 272         void (*set_my_id) (ike_sa_t *this, identification_t *me);
 273
 274         /**
 275          * @brief Get the other peer's identification.
 276          *
 277          * @param this                  calling object
 278          * @return                              identification
 279          */
 280         identification_t* (*get_other_id) (ike_sa_t *this);
 281
 282         /**
 283          * @brief Set the other peer's identification.
 284          *
 285          * @param this                  calling object
 286          * @param other                 identification
 287          */
 288         void (*set_other_id) (ike_sa_t *this, identification_t *other);
 289
 290         /**
 291          * @brief Get the other peer's certification authority
 292          *
 293          * @param this                  calling object
 294          * @return                      ca_info_t record of other ca
 295          */
 296         ca_info_t* (*get_other_ca) (ike_sa_t *this);
 297
 298         /**
 299          * @brief Set the other peer's certification authority
 300          *
 301          * @param this                  calling object
 302          * @param other_ca              ca_info_t record of other ca
 303          */
 304         void (*set_other_ca) (ike_sa_t *this, ca_info_t *other_ca);
 305
 306         /**
 307          * @brief Get the config used to setup this IKE_SA.
 308          *
 309          * @param this                  calling object
 310          * @return                              ike_config
 311          */
 312         ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
 313
 314         /**
 315          * @brief Set the config to setup this IKE_SA.
 316          *
 317          * @param this                  calling object
 318          * @param config                ike_config to use
 319          */
 320         void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
 321
 322         /**
 323          * @brief Get the peer config used by this IKE_SA.
 324          *
 325          * @param this                  calling object
 326          * @return                              peer_config
 327          */
 328         peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
 329
 330         /**
 331          * @brief Set the peer config to use with this IKE_SA.
 332          *
 333          * @param this                  calling object
 334          * @param config                peer_config to use
 335          */
 336         void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
 337
 338         /**
 339          * @brief Check if the peer supports an extension.
 340          *
 341          * @param this                  calling object
 342          * @param extension             extension to check for support
 343          * @return                              TRUE if peer supports it, FALSE otherwise
 344          */
 345         bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
 346
 347         /**
 348          * @brief Enable an extension the peer supports.
 349          *
 350          * If support for an IKE extension is detected, this method is called
 351          * to enable that extension and behave accordingly.
 352          *
 353          * @param this                  calling object
 354          * @param extension             extension to enable
 355          */
 356         void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
 357
 358         /**
 359          * @brief Initiate a new connection.
 360          *
 361          * The configs are owned by the IKE_SA after the call.
 362          *
 363          * @param this                  calling object
 364          * @param child_cfg             child config to create CHILD from
 365          * @return
 366          *                                              - SUCCESS if initialization started
 367          *                                              - DESTROY_ME if initialization failed
 368          */
 369         status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg);
 370
 371         /**
 372          * @brief Route a policy in the kernel.
 373          *
 374          * Installs the policies in the kernel. If traffic matches,
 375          * the kernel requests connection setup from the IKE_SA via acquire().
 376          *
 377          * @param this                  calling object
 378          * @param child_cfg             child config to route
 379          * @return
 380          *                                              - SUCCESS if routed successfully
 381          *                                              - FAILED if routing failed
 382          */
 383         status_t (*route) (ike_sa_t *this, child_cfg_t *child_cfg);
 384
 385         /**
 386          * @brief Unroute a policy in the kernel previously routed.
 387          *
 388          * @param this                  calling object
 389          * @param reqid                 reqid of CHILD_SA to unroute
 390          * @return
 391          *                                              - SUCCESS if route removed
 392          *                                              - NOT_FOUND if CHILD_SA not found
 393          *                                              - DESTROY_ME if last CHILD_SA was unrouted
 394          */
 395         status_t (*unroute) (ike_sa_t *this, u_int32_t reqid);
 396
 397         /**
 398          * @brief Acquire connection setup for an installed kernel policy.
 399          *
 400          * If an installed policy raises an acquire, the kernel calls
 401          * this function to establish the CHILD_SA (and maybe the IKE_SA).
 402          *
 403          * @param this                  calling object
 404          * @param reqid                 reqid of the CHILD_SA the policy belongs to.
 405          * @return
 406          *                                              - SUCCESS if initialization started
 407          *                                              - DESTROY_ME if initialization failed
 408          */
 409         status_t (*acquire) (ike_sa_t *this, u_int32_t reqid);
 410
 411         /**
 412          * @brief Initiates the deletion of an IKE_SA.
 413          *
 414          * Sends a delete message to the remote peer and waits for
 415          * its response. If the response comes in, or a timeout occurs,
 416          * the IKE SA gets deleted.
 417          *
 418          * @param this                  calling object
 419          * @return
 420          *                                              - SUCCESS if deletion is initialized
 421          *                                              - INVALID_STATE, if the IKE_SA is not in
 422          *                                                an established state and can not be
 423          *                                                delete (but destroyed).
 424          */
 425         status_t (*delete) (ike_sa_t *this);
 426
 427         /**
 428          * @brief Processes a incoming IKEv2-Message.
 429          *
 430          * Message processing may fail. If a critical failure occurs,
 431          * process_message() return DESTROY_ME. Then the caller must
 432          * destroy the IKE_SA immediatly, as it is unusable.
 433          *
 434          * @param this                  calling object
 435          * @param message       message to process
 436          * @return
 437          *                                              - SUCCESS
 438          *                                              - FAILED
 439          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 440          */
 441         status_t (*process_message) (ike_sa_t *this, message_t *message);
 442
 443         /**
 444          * @brief Generate a IKE message to send it to the peer.
 445          *
 446          * This method generates all payloads in the message and encrypts/signs
 447          * the packet.
 448          *
 449          * @param this                  calling object
 450          * @param message               message to generate
 451          * @param packet                generated output packet
 452          * @return
 453          *                                              - SUCCESS
 454          *                                              - FAILED
 455          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 456          */
 457         status_t (*generate_message) (ike_sa_t *this, message_t *message,
 458                                                                   packet_t **packet);
 459
 460         /**
 461          * @brief Retransmits a request.
 462          *
 463          * @param this                  calling object
 464          * @param message_id    ID of the request to retransmit
 465          * @return
 466          *                                              - SUCCESS
 467          *                                              - NOT_FOUND if request doesn't have to be retransmited
 468          */
 469         status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
 470
 471         /**
 472          * @brief Sends a DPD request to the peer.
 473          *
 474          * To check if a peer is still alive, periodic
 475          * empty INFORMATIONAL messages are sent if no
 476          * other traffic was received.
 477          *
 478          * @param this                  calling object
 479          * @return
 480          *                                              - SUCCESS
 481          *                                              - DESTROY_ME, if peer did not respond
 482          */
 483         status_t (*send_dpd) (ike_sa_t *this);
 484
 485         /**
 486          * @brief Sends a keep alive packet.
 487          *
 488          * To refresh NAT tables in a NAT router
 489          * between the peers, periodic empty
 490          * UDP packets are sent if no other traffic
 491          * was sent.
 492          *
 493          * @param this                  calling object
 494          */
 495         void (*send_keepalive) (ike_sa_t *this);
 496
 497         /**
 498          * @brief Check if NAT traversal is enabled for this IKE_SA.
 499          *
 500          * @param this                  calling object
 501          * @return                              TRUE if NAT traversal enabled
 502          */
 503         bool (*is_natt_enabled) (ike_sa_t *this);
 504
 505         /**
 506          * @brief Enable NAT detection for this IKE_SA.
 507          *
 508          * If a Network address translation is detected with
 509          * NAT_DETECTION notifys, a SA must switch to ports
 510          * 4500. To enable this behavior, call enable_natt().
 511          * It is relevant which peer is NATted, this is specified
 512          * with the "local" parameter. Call it twice when both
 513          * are NATted.
 514          *
 515          * @param this                  calling object
 516          * @param local                 TRUE, if we are NATted, FALSE if other
 517          */
 518         void (*enable_natt) (ike_sa_t *this, bool local);
 519
 520         /**
 521          * @brief Derive all keys and create the transforms for IKE communication.
 522          *
 523          * Keys are derived using the diffie hellman secret, nonces and internal
 524          * stored SPIs.
 525          * Key derivation differs when an IKE_SA is set up to replace an
 526          * existing IKE_SA (rekeying). The SK_d key from the old IKE_SA
 527          * is included in the derivation process.
 528          *
 529          * @param this                  calling object
 530          * @param proposal              proposal which contains algorithms to use
 531          * @param secret                secret derived from DH exchange, gets freed
 532          * @param nonce_i               initiators nonce
 533          * @param nonce_r               responders nonce
 534          * @param initiator             TRUE if initiator, FALSE otherwise
 535          * @param child_prf             PRF with SK_d key when rekeying, NULL otherwise
 536          * @param old_prf               general purpose PRF of old SA when rekeying
 537          */
 538         status_t (*derive_keys)(ike_sa_t *this, proposal_t* proposal, chunk_t secret,
 539                                                         chunk_t nonce_i, chunk_t nonce_r,
 540                                                         bool initiator, prf_t *child_prf, prf_t *old_prf);
 541
 542         /**
 543          * @brief Get a multi purpose prf for the negotiated PRF function.
 544          *
 545          * @param this                  calling object
 546          * @return                              pointer to prf_t object
 547          */
 548         prf_t *(*get_prf) (ike_sa_t *this);
 549
 550         /**
 551          * @brief Get the prf-object, which is used to derive keys for child SAs.
 552          *
 553          * @param this                  calling object
 554          * @return                              pointer to prf_t object
 555          */
 556         prf_t *(*get_child_prf) (ike_sa_t *this);
 557
 558         /**
 559          * @brief Get the key to build outgoing authentication data.
 560          *
 561          * @param this                  calling object
 562          * @return                              pointer to prf_t object
 563          */
 564         chunk_t (*get_skp_build) (ike_sa_t *this);
 565
 566         /**
 567          * @brief Get the key to verify incoming authentication data.
 568          *
 569          * @param this                  calling object
 570          * @return                              pointer to prf_t object
 571          */
 572         chunk_t (*get_skp_verify) (ike_sa_t *this);
 573
 574         /**
 575          * @brief Associates a child SA to this IKE SA
 576          *
 577          * @param this                  calling object
 578          * @param child_sa              child_sa to add
 579          */
 580         void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
 581
 582         /**
 583          * @brief Get a CHILD_SA identified by protocol and SPI.
 584          *
 585          * @param this                  calling object
 586          * @param protocol              protocol of the SA
 587          * @param spi                   SPI of the CHILD_SA
 588          * @param inbound               TRUE if SPI is inbound, FALSE if outbound
 589          * @return                              child_sa, or NULL if none found
 590          */
 591         child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
 592                                                                  u_int32_t spi, bool inbound);
 593
 594         /**
 595          * @brief Create an iterator over all CHILD_SAs.
 596          *
 597          * @param this                  calling object
 598          * @return                              iterator
 599          */
 600         iterator_t* (*create_child_sa_iterator) (ike_sa_t *this);
 601
 602         /**
 603          * @brief Rekey the CHILD SA with the specified reqid.
 604          *
 605          * Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
 606          *
 607          * @param this                  calling object
 608          * @param protocol              protocol of the SA
 609          * @param spi                   inbound SPI of the CHILD_SA
 610          * @return
 611          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 612          *                                              - SUCCESS, if rekeying initiated
 613          */
 614         status_t (*rekey_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 615
 616         /**
 617          * @brief Close the CHILD SA with the specified protocol/SPI.
 618          *
 619          * Looks for a CHILD SA owned by this IKE_SA, deletes it and
 620          * notify's the remote peer about the delete. The associated
 621          * states and policies in the kernel get deleted, if they exist.
 622          *
 623          * @param this                  calling object
 624          * @param protocol              protocol of the SA
 625          * @param spi                   inbound SPI of the CHILD_SA
 626          * @return
 627          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 628          *                                              - SUCCESS, if delete message sent
 629          */
 630         status_t (*delete_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 631
 632         /**
 633          * @brief Destroy a CHILD SA with the specified protocol/SPI.
 634          *
 635          * Looks for a CHILD SA owned by this IKE_SA and destroys it.
 636          *
 637          * @param this                  calling object
 638          * @param protocol              protocol of the SA
 639          * @param spi                   inbound SPI of the CHILD_SA
 640          * @return
 641          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 642          *                                              - SUCCESS
 643          */
 644         status_t (*destroy_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 645
 646         /**
 647          * @brief Rekey the IKE_SA.
 648          *
 649          * Sets up a new IKE_SA, moves all CHILDs to it and deletes this IKE_SA.
 650          *
 651          * @param this                  calling object
 652          * @return                              - SUCCESS, if IKE_SA rekeying initiated
 653          */
 654         status_t (*rekey) (ike_sa_t *this);
 655
 656         /**
 657          * @brief Restablish the IKE_SA.
 658          *
 659          * Create a completely new IKE_SA with authentication, recreates all children
 660          * within the IKE_SA, closes this IKE_SA.
 661          *
 662          * @param this                  calling object
 663          * @return                              DESTROY_ME to destroy the IKE_SA
 664          */
 665         status_t (*reestablish) (ike_sa_t *this);
 666
 667         /**
 668          * @brief Set the virtual IP to use for this IKE_SA and its children.
 669          *
 670          * The virtual IP is assigned per IKE_SA, not per CHILD_SA. It has the same
 671          * lifetime as the IKE_SA.
 672          *
 673          * @param this                  calling object
 674          */
 675         void (*set_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
 676
 677         /**
 678          * @brief Get the virtual IP configured.
 679          *
 680          * @param this                  calling object
 681          * @param local                 TRUE to get local virtual IP, FALSE for remote
 682          */
 683         host_t* (*get_virtual_ip) (ike_sa_t *this, bool local);
 684
 685         /**
 686          * @brief Add a DNS server to the system.
 687          *
 688          * An IRAS may send a DNS server. To use it, it is installed on the
 689          * system. The DNS entry has a lifetime until the IKE_SA gets closed.
 690          *
 691          * @param this                  calling object
 692          * @param dns                   DNS server to install on the system
 693          */
 694         void (*add_dns_server) (ike_sa_t *this, host_t *dns);
 695
 696         /**
 697          * @brief Inherit all attributes of other to this after rekeying.
 698          *
 699          * When rekeying is completed, all CHILD_SAs, the virtual IP and all
 700          * outstanding tasks are moved from other to this.
 701          * As this call may initiate inherited tasks, a status is returned.
 702          *
 703          * @param this                  calling object
 704          * @param other                 other task to inherit from
 705          * @return                              DESTROY_ME if initiation of inherited task failed
 706          */
 707         status_t (*inherit) (ike_sa_t *this, ike_sa_t *other);
 708
 709         /**
 710          * @brief Reset the IKE_SA, useable when initiating fails
 711          *
 712          * @param this                  calling object
 713          */
 714         void (*reset) (ike_sa_t *this);
 715
 716         /**
 717          * @brief Destroys a ike_sa_t object.
 718          *
 719          * @param this                  calling object
 720          */
 721         void (*destroy) (ike_sa_t *this);
 722 };
 723
 724 /**
 725  * @brief Creates an ike_sa_t object with a specific ID.
 726  *
 727  * @param ike_sa_id     ike_sa_id_t object to associate with new IKE_SA
 728  * @return                              ike_sa_t object
 729  *
 730  * @ingroup sa
 731  */
 732 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id);
 733
 734 #endif /* IKE_SA_H_ */