64267b1a188e2ea594daa46fc8b6f9deeaa34e84
[strongswan.git] / src / charon / sa / ike_sa.h
1 /*
2 * Copyright (C) 2006-2008 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2006 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 *
18 * $Id$
19 */
20
21 /**
22 * @defgroup ike_sa ike_sa
23 * @{ @ingroup sa
24 */
25
26 #ifndef IKE_SA_H_
27 #define IKE_SA_H_
28
29 typedef enum ike_extension_t ike_extension_t;
30 typedef enum ike_condition_t ike_condition_t;
31 typedef enum ike_sa_state_t ike_sa_state_t;
32 typedef enum statistic_t statistic_t;
33 typedef struct ike_sa_t ike_sa_t;
34
35 #include <library.h>
36 #include <encoding/message.h>
37 #include <encoding/payloads/proposal_substructure.h>
38 #include <sa/ike_sa_id.h>
39 #include <sa/child_sa.h>
40 #include <sa/tasks/task.h>
41 #include <crypto/prfs/prf.h>
42 #include <crypto/crypters/crypter.h>
43 #include <crypto/signers/signer.h>
44 #include <config/peer_cfg.h>
45 #include <config/ike_cfg.h>
46 #include <credentials/auth_info.h>
47
48 /**
49 * Timeout in milliseconds after that a half open IKE_SA gets deleted.
50 */
51 #define HALF_OPEN_IKE_SA_TIMEOUT 30000
52
53 /**
54 * Interval to send keepalives when NATed, in seconds.
55 */
56 #define KEEPALIVE_INTERVAL 20
57
58 /**
59 * After which time rekeying should be retried if it failed, in seconds.
60 */
61 #define RETRY_INTERVAL 30
62
63 /**
64 * Jitter to subtract from RETRY_INTERVAL to randomize rekey retry.
65 */
66 #define RETRY_JITTER 20
67
68 /**
69 * Extensions (or optional features) the peer supports
70 */
71 enum ike_extension_t {
72
73 /**
74 * peer supports NAT traversal as specified in RFC4306
75 */
76 EXT_NATT = (1<<0),
77
78 /**
79 * peer supports MOBIKE (RFC4555)
80 */
81 EXT_MOBIKE = (1<<1),
82
83 /**
84 * peer supports HTTP cert lookups as specified in RFC4306
85 */
86 EXT_HASH_AND_URL = (1<<2),
87 };
88
89 /**
90 * Conditions of an IKE_SA, change during its lifetime
91 */
92 enum ike_condition_t {
93
94 /**
95 * Connection is natted (or faked) somewhere
96 */
97 COND_NAT_ANY = (1<<0),
98
99 /**
100 * we are behind NAT
101 */
102 COND_NAT_HERE = (1<<1),
103
104 /**
105 * other is behind NAT
106 */
107 COND_NAT_THERE = (1<<2),
108
109 /**
110 * Faking NAT to enforce UDP encapsulation
111 */
112 COND_NAT_FAKE = (1<<3),
113
114 /**
115 * peer has ben authenticated using EAP
116 */
117 COND_EAP_AUTHENTICATED = (1<<4),
118
119 /**
120 * received a certificate request from the peer
121 */
122 COND_CERTREQ_SEEN = (1<<5),
123 };
124
125 /**
126 * Information and statistics to query from an SA
127 */
128 enum statistic_t {
129
130 /**
131 * Relative time for scheduled rekeying
132 */
133 STAT_REKEY_TIME,
134
135 /**
136 * Relative time for scheduled reauthentication
137 */
138 STAT_REAUTH_TIME,
139 };
140
141 /**
142 * State of an IKE_SA.
143 *
144 * An IKE_SA passes various states in its lifetime. A newly created
145 * SA is in the state CREATED.
146 * @verbatim
147 +----------------+
148 ¦ SA_CREATED ¦
149 +----------------+
150 ¦
151 on initiate()---> ¦ <----- on IKE_SA_INIT received
152 V
153 +----------------+
154 ¦ SA_CONNECTING ¦
155 +----------------+
156 ¦
157 ¦ <----- on IKE_AUTH successfully completed
158 V
159 +----------------+
160 ¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
161 +----------------+ ¦
162 ¦ V
163 on delete()---> ¦ <----- on IKE_SA +-------------+
164 ¦ delete request ¦ SA_REKEYING ¦
165 ¦ received +-------------+
166 V ¦
167 +----------------+ ¦
168 ¦ SA_DELETING ¦<------------------------+ <-- after rekeying
169 +----------------+
170 ¦
171 ¦ <----- after delete() acknowledged
172 ¦
173 \V/
174 X
175 / \
176 @endverbatim
177 */
178 enum ike_sa_state_t {
179
180 /**
181 * IKE_SA just got created, but is not initiating nor responding yet.
182 */
183 IKE_CREATED,
184
185 /**
186 * IKE_SA gets initiated actively or passively
187 */
188 IKE_CONNECTING,
189
190 /**
191 * IKE_SA is fully established
192 */
193 IKE_ESTABLISHED,
194
195 /**
196 * IKE_SA rekeying in progress
197 */
198 IKE_REKEYING,
199
200 /**
201 * IKE_SA is in progress of deletion
202 */
203 IKE_DELETING,
204
205 /**
206 * IKE_SA object gets destroyed
207 */
208 IKE_DESTROYING,
209 };
210
211 /**
212 * enum names for ike_sa_state_t.
213 */
214 extern enum_name_t *ike_sa_state_names;
215
216 /**
217 * Class ike_sa_t representing an IKE_SA.
218 *
219 * An IKE_SA contains crypto information related to a connection
220 * with a peer. It contains multiple IPsec CHILD_SA, for which
221 * it is responsible. All traffic is handled by an IKE_SA, using
222 * the task manager and its tasks.
223 */
224 struct ike_sa_t {
225
226 /**
227 * Get the id of the SA.
228 *
229 * Returned ike_sa_id_t object is not getting cloned!
230 *
231 * @return ike_sa's ike_sa_id_t
232 */
233 ike_sa_id_t* (*get_id) (ike_sa_t *this);
234
235 /**
236 * Get the numerical ID uniquely defining this IKE_SA.
237 *
238 * @return unique ID
239 */
240 u_int32_t (*get_unique_id) (ike_sa_t *this);
241
242 /**
243 * Get the state of the IKE_SA.
244 *
245 * @return state of the IKE_SA
246 */
247 ike_sa_state_t (*get_state) (ike_sa_t *this);
248
249 /**
250 * Set the state of the IKE_SA.
251 *
252 * @param state state to set for the IKE_SA
253 */
254 void (*set_state) (ike_sa_t *this, ike_sa_state_t ike_sa);
255
256 /**
257 * Get the name of the connection this IKE_SA uses.
258 *
259 * @return name
260 */
261 char* (*get_name) (ike_sa_t *this);
262
263 /**
264 * Get statistic values from the IKE_SA.
265 *
266 * @param kind kind of requested value
267 * @return value as integer
268 */
269 u_int32_t (*get_statistic)(ike_sa_t *this, statistic_t kind);
270
271 /**
272 * Get the own host address.
273 *
274 * @return host address
275 */
276 host_t* (*get_my_host) (ike_sa_t *this);
277
278 /**
279 * Set the own host address.
280 *
281 * @param me host address
282 */
283 void (*set_my_host) (ike_sa_t *this, host_t *me);
284
285 /**
286 * Get the other peers host address.
287 *
288 * @return host address
289 */
290 host_t* (*get_other_host) (ike_sa_t *this);
291
292 /**
293 * Set the others host address.
294 *
295 * @param other host address
296 */
297 void (*set_other_host) (ike_sa_t *this, host_t *other);
298
299 /**
300 * Update the IKE_SAs host.
301 *
302 * Hosts may be NULL to use current host.
303 *
304 * @param me new local host address, or NULL
305 * @param other new remote host address, or NULL
306 */
307 void (*update_hosts)(ike_sa_t *this, host_t *me, host_t *other);
308
309 /**
310 * Get the own identification.
311 *
312 * @return identification
313 */
314 identification_t* (*get_my_id) (ike_sa_t *this);
315
316 /**
317 * Set the own identification.
318 *
319 * @param me identification
320 */
321 void (*set_my_id) (ike_sa_t *this, identification_t *me);
322
323 /**
324 * Get the other peer's identification.
325 *
326 * @return identification
327 */
328 identification_t* (*get_other_id) (ike_sa_t *this);
329
330 /**
331 * Set the other peer's identification.
332 *
333 * @param other identification
334 */
335 void (*set_other_id) (ike_sa_t *this, identification_t *other);
336
337 /**
338 * Get the peers EAP identity.
339 *
340 * The EAP identity is exchanged in a EAP-Identity exchange.
341 *
342 * @return identification, NULL if none set
343 */
344 identification_t* (*get_eap_identity) (ike_sa_t *this);
345
346 /**
347 * Set the peer's EAP identity.
348 *
349 * @param id identification
350 */
351 void (*set_eap_identity) (ike_sa_t *this, identification_t *id);
352
353 /**
354 * Get the config used to setup this IKE_SA.
355 *
356 * @return ike_config
357 */
358 ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
359
360 /**
361 * Set the config to setup this IKE_SA.
362 *
363 * @param config ike_config to use
364 */
365 void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
366
367 /**
368 * Get the peer config used by this IKE_SA.
369 *
370 * @return peer_config
371 */
372 peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
373
374 /**
375 * Set the peer config to use with this IKE_SA.
376 *
377 * @param config peer_config to use
378 */
379 void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
380
381 /**
382 * Get authentication/authorization info for local peer.
383 *
384 * @return auth_info for me
385 */
386 auth_info_t* (*get_my_auth)(ike_sa_t *this);
387
388 /**
389 * Get authentication/authorization info for remote peer.
390 *
391 * @return auth_info for me
392 */
393 auth_info_t* (*get_other_auth)(ike_sa_t *this);
394
395 /**
396 * Add an additional address for the peer.
397 *
398 * In MOBIKE, a peer may transmit additional addresses where it is
399 * reachable. These are stored in the IKE_SA.
400 * The own list of addresses is not stored, they are queried from
401 * the kernel when required.
402 *
403 * @param host host to add to list
404 */
405 void (*add_additional_address)(ike_sa_t *this, host_t *host);
406
407 /**
408 * Create an iterator over all additional addresses of the peer.
409 *
410 * @return iterator over addresses
411 */
412 iterator_t* (*create_additional_address_iterator)(ike_sa_t *this);
413
414 /**
415 * Check if mappings have changed on a NAT for our source address.
416 *
417 * @param hash received DESTINATION_IP hash
418 * @return TRUE if mappings have changed
419 */
420 bool (*has_mapping_changed)(ike_sa_t *this, chunk_t hash);
421
422 /**
423 * Enable an extension the peer supports.
424 *
425 * If support for an IKE extension is detected, this method is called
426 * to enable that extension and behave accordingly.
427 *
428 * @param extension extension to enable
429 */
430 void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
431
432 /**
433 * Check if the peer supports an extension.
434 *
435 * @param extension extension to check for support
436 * @return TRUE if peer supports it, FALSE otherwise
437 */
438 bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
439
440 /**
441 * Enable/disable a condition flag for this IKE_SA.
442 *
443 * @param condition condition to enable/disable
444 * @param enable TRUE to enable condition, FALSE to disable
445 */
446 void (*set_condition) (ike_sa_t *this, ike_condition_t condition, bool enable);
447
448 /**
449 * Check if a condition flag is set.
450 *
451 * @param condition condition to check
452 * @return TRUE if condition flag set, FALSE otherwise
453 */
454 bool (*has_condition) (ike_sa_t *this, ike_condition_t condition);
455
456 /**
457 * Get the number of queued MOBIKE address updates.
458 *
459 * @return number of pending updates
460 */
461 u_int32_t (*get_pending_updates)(ike_sa_t *this);
462
463 /**
464 * Set the number of queued MOBIKE address updates.
465 *
466 * @param updates number of pending updates
467 */
468 void (*set_pending_updates)(ike_sa_t *this, u_int32_t updates);
469
470 /**
471 * Check if we are the original initiator of this IKE_SA (rekeying does not
472 * change this flag).
473 */
474 bool (*is_ike_initiator)(ike_sa_t *this);
475
476
477 #ifdef ME
478 /**
479 * Activate mediation server functionality for this IKE_SA.
480 */
481 void (*act_as_mediation_server) (ike_sa_t *this);
482
483 /**
484 * Get the server reflexive host.
485 *
486 * @return server reflexive host
487 */
488 host_t* (*get_server_reflexive_host) (ike_sa_t *this);
489
490 /**
491 * Set the server reflexive host.
492 *
493 * @param host server reflexive host
494 */
495 void (*set_server_reflexive_host) (ike_sa_t *this, host_t *host);
496
497 /**
498 * Get the connect ID.
499 *
500 * @return connect ID
501 */
502 chunk_t (*get_connect_id) (ike_sa_t *this);
503
504 /**
505 * Initiate the mediation of a mediated connection (i.e. initiate a
506 * ME_CONNECT exchange).
507 *
508 * @param mediated_cfg peer_cfg of the mediated connection
509 * @return
510 * - SUCCESS if initialization started
511 * - DESTROY_ME if initialization failed
512 */
513 status_t (*initiate_mediation) (ike_sa_t *this, peer_cfg_t *mediated_cfg);
514
515 /**
516 * Initiate the mediated connection
517 *
518 * @param me local endpoint (gets cloned)
519 * @param other remote endpoint (gets cloned)
520 * @param connect_id connect ID (gets cloned)
521 * @return
522 * - SUCCESS if initialization started
523 * - DESTROY_ME if initialization failed
524 */
525 status_t (*initiate_mediated) (ike_sa_t *this, host_t *me, host_t *other,
526 chunk_t connect_id);
527
528 /**
529 * Relay data from one peer to another (i.e. initiate a
530 * ME_CONNECT exchange).
531 *
532 * Data is cloned.
533 *
534 * @param requester ID of the requesting peer
535 * @param connect_id data of the ME_CONNECTID payload
536 * @param connect_key data of the ME_CONNECTKEY payload
537 * @param endpoints endpoints
538 * @param response TRUE if this is a response
539 * @return
540 * - SUCCESS if relay started
541 * - DESTROY_ME if relay failed
542 */
543 status_t (*relay) (ike_sa_t *this, identification_t *requester, chunk_t connect_id,
544 chunk_t connect_key, linked_list_t *endpoints, bool response);
545
546 /**
547 * Send a callback to a peer.
548 *
549 * Data is cloned.
550 *
551 * @param peer_id ID of the other peer
552 * @return
553 * - SUCCESS if response started
554 * - DESTROY_ME if response failed
555 */
556 status_t (*callback) (ike_sa_t *this, identification_t *peer_id);
557
558 /**
559 * Respond to a ME_CONNECT request.
560 *
561 * Data is cloned.
562 *
563 * @param peer_id ID of the other peer
564 * @param connect_id the connect ID supplied by the initiator
565 * @return
566 * - SUCCESS if response started
567 * - DESTROY_ME if response failed
568 */
569 status_t (*respond) (ike_sa_t *this, identification_t *peer_id, chunk_t connect_id);
570 #endif /* ME */
571
572 /**
573 * Initiate a new connection.
574 *
575 * The configs are owned by the IKE_SA after the call.
576 *
577 * @param child_cfg child config to create CHILD from
578 * @return
579 * - SUCCESS if initialization started
580 * - DESTROY_ME if initialization failed
581 */
582 status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg);
583
584 /**
585 * Route a policy in the kernel.
586 *
587 * Installs the policies in the kernel. If traffic matches,
588 * the kernel requests connection setup from the IKE_SA via acquire().
589 *
590 * @param child_cfg child config to route
591 * @return
592 * - SUCCESS if routed successfully
593 * - FAILED if routing failed
594 */
595 status_t (*route) (ike_sa_t *this, child_cfg_t *child_cfg);
596
597 /**
598 * Unroute a policy in the kernel previously routed.
599 *
600 * @param reqid reqid of CHILD_SA to unroute
601 * @return
602 * - SUCCESS if route removed
603 * - NOT_FOUND if CHILD_SA not found
604 * - DESTROY_ME if last CHILD_SA was unrouted
605 */
606 status_t (*unroute) (ike_sa_t *this, u_int32_t reqid);
607
608 /**
609 * Acquire connection setup for an installed kernel policy.
610 *
611 * If an installed policy raises an acquire, the kernel calls
612 * this function to establish the CHILD_SA (and maybe the IKE_SA).
613 *
614 * @param reqid reqid of the CHILD_SA the policy belongs to.
615 * @return
616 * - SUCCESS if initialization started
617 * - DESTROY_ME if initialization failed
618 */
619 status_t (*acquire) (ike_sa_t *this, u_int32_t reqid);
620
621 /**
622 * Initiates the deletion of an IKE_SA.
623 *
624 * Sends a delete message to the remote peer and waits for
625 * its response. If the response comes in, or a timeout occurs,
626 * the IKE SA gets deleted.
627 *
628 * @return
629 * - SUCCESS if deletion is initialized
630 * - INVALID_STATE, if the IKE_SA is not in
631 * an established state and can not be
632 * delete (but destroyed).
633 */
634 status_t (*delete) (ike_sa_t *this);
635
636 /**
637 * Update IKE_SAs after network interfaces have changed.
638 *
639 * Whenever the network interface configuration changes, the kernel
640 * interface calls roam() on each IKE_SA. The IKE_SA then checks if
641 * the new network config requires changes, and handles appropriate.
642 * If MOBIKE is supported, addresses are updated; If not, the tunnel is
643 * restarted.
644 *
645 * @param address TRUE if address list changed, FALSE otherwise
646 * @return SUCCESS, FAILED, DESTROY_ME
647 */
648 status_t (*roam)(ike_sa_t *this, bool address);
649
650 /**
651 * Processes a incoming IKEv2-Message.
652 *
653 * Message processing may fail. If a critical failure occurs,
654 * process_message() return DESTROY_ME. Then the caller must
655 * destroy the IKE_SA immediatly, as it is unusable.
656 *
657 * @param message message to process
658 * @return
659 * - SUCCESS
660 * - FAILED
661 * - DESTROY_ME if this IKE_SA MUST be deleted
662 */
663 status_t (*process_message) (ike_sa_t *this, message_t *message);
664
665 /**
666 * Generate a IKE message to send it to the peer.
667 *
668 * This method generates all payloads in the message and encrypts/signs
669 * the packet.
670 *
671 * @param message message to generate
672 * @param packet generated output packet
673 * @return
674 * - SUCCESS
675 * - FAILED
676 * - DESTROY_ME if this IKE_SA MUST be deleted
677 */
678 status_t (*generate_message) (ike_sa_t *this, message_t *message,
679 packet_t **packet);
680
681 /**
682 * Retransmits a request.
683 *
684 * @param message_id ID of the request to retransmit
685 * @return
686 * - SUCCESS
687 * - NOT_FOUND if request doesn't have to be retransmited
688 */
689 status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
690
691 /**
692 * Sends a DPD request to the peer.
693 *
694 * To check if a peer is still alive, periodic
695 * empty INFORMATIONAL messages are sent if no
696 * other traffic was received.
697 *
698 * @return
699 * - SUCCESS
700 * - DESTROY_ME, if peer did not respond
701 */
702 status_t (*send_dpd) (ike_sa_t *this);
703
704 /**
705 * Sends a keep alive packet.
706 *
707 * To refresh NAT tables in a NAT router
708 * between the peers, periodic empty
709 * UDP packets are sent if no other traffic
710 * was sent.
711 */
712 void (*send_keepalive) (ike_sa_t *this);
713
714 /**
715 * Derive all keys and create the transforms for IKE communication.
716 *
717 * Keys are derived using the diffie hellman secret, nonces and internal
718 * stored SPIs.
719 * Key derivation differs when an IKE_SA is set up to replace an
720 * existing IKE_SA (rekeying). The SK_d key from the old IKE_SA
721 * is included in the derivation process.
722 *
723 * @param proposal proposal which contains algorithms to use
724 * @param secret secret derived from DH exchange, gets freed
725 * @param nonce_i initiators nonce
726 * @param nonce_r responders nonce
727 * @param initiator TRUE if initiator, FALSE otherwise
728 * @param child_prf PRF with SK_d key when rekeying, NULL otherwise
729 * @param old_prf general purpose PRF of old SA when rekeying
730 */
731 status_t (*derive_keys)(ike_sa_t *this, proposal_t* proposal, chunk_t secret,
732 chunk_t nonce_i, chunk_t nonce_r,
733 bool initiator, prf_t *child_prf, prf_t *old_prf);
734
735 /**
736 * Get the selected IKE proposal string
737 *
738 * @return string describing the selected IKE proposal
739 */
740 char* (*get_proposal)(ike_sa_t *this);
741
742 /**
743 * Set the selected IKE proposal string for status information purposes
744 * (the "%P" printf format handler is used)
745 *
746 * @param proposal string describing the selected IKE proposal
747 */
748 void (*set_proposal)(ike_sa_t *this, char *proposal);
749
750 /**
751 * Get a multi purpose prf for the negotiated PRF function.
752 *
753 * @return pointer to prf_t object
754 */
755 prf_t *(*get_prf) (ike_sa_t *this);
756
757 /**
758 * Get the prf-object, which is used to derive keys for child SAs.
759 *
760 * @return pointer to prf_t object
761 */
762 prf_t *(*get_child_prf) (ike_sa_t *this);
763
764 /**
765 * Get the key to build outgoing authentication data.
766 *
767 * @return pointer to prf_t object
768 */
769 chunk_t (*get_skp_build) (ike_sa_t *this);
770
771 /**
772 * Get the key to verify incoming authentication data.
773 *
774 * @return pointer to prf_t object
775 */
776 chunk_t (*get_skp_verify) (ike_sa_t *this);
777
778 /**
779 * Associates a child SA to this IKE SA
780 *
781 * @param child_sa child_sa to add
782 */
783 void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
784
785 /**
786 * Get a CHILD_SA identified by protocol and SPI.
787 *
788 * @param protocol protocol of the SA
789 * @param spi SPI of the CHILD_SA
790 * @param inbound TRUE if SPI is inbound, FALSE if outbound
791 * @return child_sa, or NULL if none found
792 */
793 child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
794 u_int32_t spi, bool inbound);
795
796 /**
797 * Create an iterator over all CHILD_SAs.
798 *
799 * @return iterator
800 */
801 iterator_t* (*create_child_sa_iterator) (ike_sa_t *this);
802
803 /**
804 * Rekey the CHILD SA with the specified reqid.
805 *
806 * Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
807 *
808 * @param protocol protocol of the SA
809 * @param spi inbound SPI of the CHILD_SA
810 * @return
811 * - NOT_FOUND, if IKE_SA has no such CHILD_SA
812 * - SUCCESS, if rekeying initiated
813 */
814 status_t (*rekey_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
815
816 /**
817 * Close the CHILD SA with the specified protocol/SPI.
818 *
819 * Looks for a CHILD SA owned by this IKE_SA, deletes it and
820 * notify's the remote peer about the delete. The associated
821 * states and policies in the kernel get deleted, if they exist.
822 *
823 * @param protocol protocol of the SA
824 * @param spi inbound SPI of the CHILD_SA
825 * @return
826 * - NOT_FOUND, if IKE_SA has no such CHILD_SA
827 * - SUCCESS, if delete message sent
828 */
829 status_t (*delete_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
830
831 /**
832 * Destroy a CHILD SA with the specified protocol/SPI.
833 *
834 * Looks for a CHILD SA owned by this IKE_SA and destroys it.
835 *
836 * @param protocol protocol of the SA
837 * @param spi inbound SPI of the CHILD_SA
838 * @return
839 * - NOT_FOUND, if IKE_SA has no such CHILD_SA
840 * - SUCCESS
841 */
842 status_t (*destroy_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
843
844 /**
845 * Rekey the IKE_SA.
846 *
847 * Sets up a new IKE_SA, moves all CHILDs to it and deletes this IKE_SA.
848 *
849 * @return - SUCCESS, if IKE_SA rekeying initiated
850 */
851 status_t (*rekey) (ike_sa_t *this);
852
853 /**
854 * Reauthenticate the IKE_SA.
855 *
856 * Create a completely new IKE_SA with authentication, recreates all children
857 * within the IKE_SA, closes this IKE_SA.
858 *
859 * @return DESTROY_ME to destroy the IKE_SA
860 */
861 status_t (*reauth) (ike_sa_t *this);
862
863 /**
864 * Restablish the IKE_SA.
865 *
866 * Reestablish an IKE_SA after it has been closed.
867 *
868 * @return DESTROY_ME to destroy the IKE_SA
869 */
870 status_t (*reestablish) (ike_sa_t *this);
871
872 /**
873 * Set the lifetime limit received from a AUTH_LIFETIME notify.
874 *
875 * @param lifetime lifetime in seconds
876 */
877 void (*set_auth_lifetime)(ike_sa_t *this, u_int32_t lifetime);
878
879 /**
880 * Set the virtual IP to use for this IKE_SA and its children.
881 *
882 * The virtual IP is assigned per IKE_SA, not per CHILD_SA. It has the same
883 * lifetime as the IKE_SA.
884 *
885 * @param local TRUE to set local address, FALSE for remote
886 * @param ip IP to set as virtual IP
887 */
888 void (*set_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
889
890 /**
891 * Get the virtual IP configured.
892 *
893 * @param local TRUE to get local virtual IP, FALSE for remote
894 * @return host_t *virtual IP
895 */
896 host_t* (*get_virtual_ip) (ike_sa_t *this, bool local);
897
898 /**
899 * Add a DNS server to the system.
900 *
901 * An IRAS may send a DNS server. To use it, it is installed on the
902 * system. The DNS entry has a lifetime until the IKE_SA gets closed.
903 *
904 * @param dns DNS server to install on the system
905 */
906 void (*add_dns_server) (ike_sa_t *this, host_t *dns);
907
908 /**
909 * Inherit all attributes of other to this after rekeying.
910 *
911 * When rekeying is completed, all CHILD_SAs, the virtual IP and all
912 * outstanding tasks are moved from other to this.
913 * As this call may initiate inherited tasks, a status is returned.
914 *
915 * @param other other task to inherit from
916 * @return DESTROY_ME if initiation of inherited task failed
917 */
918 status_t (*inherit) (ike_sa_t *this, ike_sa_t *other);
919
920 /**
921 * Reset the IKE_SA, useable when initiating fails
922 */
923 void (*reset) (ike_sa_t *this);
924
925 /**
926 * Destroys a ike_sa_t object.
927 */
928 void (*destroy) (ike_sa_t *this);
929 };
930
931 /**
932 * Creates an ike_sa_t object with a specific ID.
933 *
934 * @param ike_sa_id ike_sa_id_t object to associate with new IKE_SA
935 * @return ike_sa_t object
936 */
937 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id);
938
939 #endif /* IKE_SA_H_ @} */