projects / strongswan.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
store IKE proposal implicitly during derive_keys
[strongswan.git] / src / charon / sa / ike_sa.h
1 /*
2 * Copyright (C) 2006-2008 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2006 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 *
18 * $Id$
19 */
20
21 /**
22 * @defgroup ike_sa ike_sa
23 * @{ @ingroup sa
24 */
25
26 #ifndef IKE_SA_H_
27 #define IKE_SA_H_
28
29 typedef enum ike_extension_t ike_extension_t;
30 typedef enum ike_condition_t ike_condition_t;
31 typedef enum ike_sa_state_t ike_sa_state_t;
32 typedef enum statistic_t statistic_t;
33 typedef struct ike_sa_t ike_sa_t;
34
35 #include <library.h>
36 #include <encoding/message.h>
37 #include <encoding/payloads/proposal_substructure.h>
38 #include <sa/ike_sa_id.h>
39 #include <sa/child_sa.h>
40 #include <sa/tasks/task.h>
41 #include <crypto/prfs/prf.h>
42 #include <crypto/crypters/crypter.h>
43 #include <crypto/signers/signer.h>
44 #include <config/peer_cfg.h>
45 #include <config/ike_cfg.h>
46 #include <credentials/auth_info.h>
47
48 /**
49 * Timeout in milliseconds after that a half open IKE_SA gets deleted.
50 */
51 #define HALF_OPEN_IKE_SA_TIMEOUT 30000
52
53 /**
54 * Interval to send keepalives when NATed, in seconds.
55 */
56 #define KEEPALIVE_INTERVAL 20
57
58 /**
59 * After which time rekeying should be retried if it failed, in seconds.
60 */
61 #define RETRY_INTERVAL 30
62
63 /**
64 * Jitter to subtract from RETRY_INTERVAL to randomize rekey retry.
65 */
66 #define RETRY_JITTER 20
67
68 /**
69 * Extensions (or optional features) the peer supports
70 */
71 enum ike_extension_t {
72
73 /**
74 * peer supports NAT traversal as specified in RFC4306
75 */
76 EXT_NATT = (1<<0),
77
78 /**
79 * peer supports MOBIKE (RFC4555)
80 */
81 EXT_MOBIKE = (1<<1),
82
83 /**
84 * peer supports HTTP cert lookups as specified in RFC4306
85 */
86 EXT_HASH_AND_URL = (1<<2),
87 };
88
89 /**
90 * Conditions of an IKE_SA, change during its lifetime
91 */
92 enum ike_condition_t {
93
94 /**
95 * Connection is natted (or faked) somewhere
96 */
97 COND_NAT_ANY = (1<<0),
98
99 /**
100 * we are behind NAT
101 */
102 COND_NAT_HERE = (1<<1),
103
104 /**
105 * other is behind NAT
106 */
107 COND_NAT_THERE = (1<<2),
108
109 /**
110 * Faking NAT to enforce UDP encapsulation
111 */
112 COND_NAT_FAKE = (1<<3),
113
114 /**
115 * peer has ben authenticated using EAP
116 */
117 COND_EAP_AUTHENTICATED = (1<<4),
118
119 /**
120 * received a certificate request from the peer
121 */
122 COND_CERTREQ_SEEN = (1<<5),
123 };
124
125 /**
126 * Timing information and statistics to query from an SA
127 */
128 enum statistic_t {
129 /** Timestamp of SA establishement */
130 STAT_ESTABLISHED = 0,
131 /** Timestamp of scheudled rekeying */
132 STAT_REKEY,
133 /** Timestamp of scheudled reauthentication */
134 STAT_REAUTH,
135 /** Timestamp of scheudled delete */
136 STAT_DELETE,
137 /** Timestamp of last inbound IKE packet */
138 STAT_INBOUND,
139 /** Timestamp of last outbound IKE packet */
140 STAT_OUTBOUND,
141
142 STAT_MAX
143 };
144
145 /**
146 * State of an IKE_SA.
147 *
148 * An IKE_SA passes various states in its lifetime. A newly created
149 * SA is in the state CREATED.
150 * @verbatim
151 +----------------+
152 ¦ SA_CREATED ¦
153 +----------------+
154 ¦
155 on initiate()---> ¦ <----- on IKE_SA_INIT received
156 V
157 +----------------+
158 ¦ SA_CONNECTING ¦
159 +----------------+
160 ¦
161 ¦ <----- on IKE_AUTH successfully completed
162 V
163 +----------------+
164 ¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
165 +----------------+ ¦
166 ¦ V
167 on delete()---> ¦ <----- on IKE_SA +-------------+
168 ¦ delete request ¦ SA_REKEYING ¦
169 ¦ received +-------------+
170 V ¦
171 +----------------+ ¦
172 ¦ SA_DELETING ¦<------------------------+ <-- after rekeying
173 +----------------+
174 ¦
175 ¦ <----- after delete() acknowledged
176 ¦
177 \V/
178 X
179 / \
180 @endverbatim
181 */
182 enum ike_sa_state_t {
183
184 /**
185 * IKE_SA just got created, but is not initiating nor responding yet.
186 */
187 IKE_CREATED,
188
189 /**
190 * IKE_SA gets initiated actively or passively
191 */
192 IKE_CONNECTING,
193
194 /**
195 * IKE_SA is fully established
196 */
197 IKE_ESTABLISHED,
198
199 /**
200 * IKE_SA rekeying in progress
201 */
202 IKE_REKEYING,
203
204 /**
205 * IKE_SA is in progress of deletion
206 */
207 IKE_DELETING,
208
209 /**
210 * IKE_SA object gets destroyed
211 */
212 IKE_DESTROYING,
213 };
214
215 /**
216 * enum names for ike_sa_state_t.
217 */
218 extern enum_name_t *ike_sa_state_names;
219
220 /**
221 * Class ike_sa_t representing an IKE_SA.
222 *
223 * An IKE_SA contains crypto information related to a connection
224 * with a peer. It contains multiple IPsec CHILD_SA, for which
225 * it is responsible. All traffic is handled by an IKE_SA, using
226 * the task manager and its tasks.
227 */
228 struct ike_sa_t {
229
230 /**
231 * Get the id of the SA.
232 *
233 * Returned ike_sa_id_t object is not getting cloned!
234 *
235 * @return ike_sa's ike_sa_id_t
236 */
237 ike_sa_id_t* (*get_id) (ike_sa_t *this);
238
239 /**
240 * Get the numerical ID uniquely defining this IKE_SA.
241 *
242 * @return unique ID
243 */
244 u_int32_t (*get_unique_id) (ike_sa_t *this);
245
246 /**
247 * Get the state of the IKE_SA.
248 *
249 * @return state of the IKE_SA
250 */
251 ike_sa_state_t (*get_state) (ike_sa_t *this);
252
253 /**
254 * Set the state of the IKE_SA.
255 *
256 * @param state state to set for the IKE_SA
257 */
258 void (*set_state) (ike_sa_t *this, ike_sa_state_t ike_sa);
259
260 /**
261 * Get the name of the connection this IKE_SA uses.
262 *
263 * @return name
264 */
265 char* (*get_name) (ike_sa_t *this);
266
267 /**
268 * Get statistic values from the IKE_SA.
269 *
270 * @param kind kind of requested value
271 * @return value as integer
272 */
273 u_int32_t (*get_statistic)(ike_sa_t *this, statistic_t kind);
274
275 /**
276 * Get the own host address.
277 *
278 * @return host address
279 */
280 host_t* (*get_my_host) (ike_sa_t *this);
281
282 /**
283 * Set the own host address.
284 *
285 * @param me host address
286 */
287 void (*set_my_host) (ike_sa_t *this, host_t *me);
288
289 /**
290 * Get the other peers host address.
291 *
292 * @return host address
293 */
294 host_t* (*get_other_host) (ike_sa_t *this);
295
296 /**
297 * Set the others host address.
298 *
299 * @param other host address
300 */
301 void (*set_other_host) (ike_sa_t *this, host_t *other);
302
303 /**
304 * Update the IKE_SAs host.
305 *
306 * Hosts may be NULL to use current host.
307 *
308 * @param me new local host address, or NULL
309 * @param other new remote host address, or NULL
310 */
311 void (*update_hosts)(ike_sa_t *this, host_t *me, host_t *other);
312
313 /**
314 * Get the own identification.
315 *
316 * @return identification
317 */
318 identification_t* (*get_my_id) (ike_sa_t *this);
319
320 /**
321 * Set the own identification.
322 *
323 * @param me identification
324 */
325 void (*set_my_id) (ike_sa_t *this, identification_t *me);
326
327 /**
328 * Get the other peer's identification.
329 *
330 * @return identification
331 */
332 identification_t* (*get_other_id) (ike_sa_t *this);
333
334 /**
335 * Set the other peer's identification.
336 *
337 * @param other identification
338 */
339 void (*set_other_id) (ike_sa_t *this, identification_t *other);
340
341 /**
342 * Get the peers EAP identity.
343 *
344 * The EAP identity is exchanged in a EAP-Identity exchange.
345 *
346 * @return identification, NULL if none set
347 */
348 identification_t* (*get_eap_identity) (ike_sa_t *this);
349
350 /**
351 * Set the peer's EAP identity.
352 *
353 * @param id identification
354 */
355 void (*set_eap_identity) (ike_sa_t *this, identification_t *id);
356
357 /**
358 * Get the config used to setup this IKE_SA.
359 *
360 * @return ike_config
361 */
362 ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
363
364 /**
365 * Set the config to setup this IKE_SA.
366 *
367 * @param config ike_config to use
368 */
369 void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
370
371 /**
372 * Get the peer config used by this IKE_SA.
373 *
374 * @return peer_config
375 */
376 peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
377
378 /**
379 * Set the peer config to use with this IKE_SA.
380 *
381 * @param config peer_config to use
382 */
383 void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
384
385 /**
386 * Get authentication/authorization info for local peer.
387 *
388 * @return auth_info for me
389 */
390 auth_info_t* (*get_my_auth)(ike_sa_t *this);
391
392 /**
393 * Get authentication/authorization info for remote peer.
394 *
395 * @return auth_info for me
396 */
397 auth_info_t* (*get_other_auth)(ike_sa_t *this);
398
399 /**
400 * Add an additional address for the peer.
401 *
402 * In MOBIKE, a peer may transmit additional addresses where it is
403 * reachable. These are stored in the IKE_SA.
404 * The own list of addresses is not stored, they are queried from
405 * the kernel when required.
406 *
407 * @param host host to add to list
408 */
409 void (*add_additional_address)(ike_sa_t *this, host_t *host);
410
411 /**
412 * Create an iterator over all additional addresses of the peer.
413 *
414 * @return iterator over addresses
415 */
416 iterator_t* (*create_additional_address_iterator)(ike_sa_t *this);
417
418 /**
419 * Check if mappings have changed on a NAT for our source address.
420 *
421 * @param hash received DESTINATION_IP hash
422 * @return TRUE if mappings have changed
423 */
424 bool (*has_mapping_changed)(ike_sa_t *this, chunk_t hash);
425
426 /**
427 * Enable an extension the peer supports.
428 *
429 * If support for an IKE extension is detected, this method is called
430 * to enable that extension and behave accordingly.
431 *
432 * @param extension extension to enable
433 */
434 void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
435
436 /**
437 * Check if the peer supports an extension.
438 *
439 * @param extension extension to check for support
440 * @return TRUE if peer supports it, FALSE otherwise
441 */
442 bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
443
444 /**
445 * Enable/disable a condition flag for this IKE_SA.
446 *
447 * @param condition condition to enable/disable
448 * @param enable TRUE to enable condition, FALSE to disable
449 */
450 void (*set_condition) (ike_sa_t *this, ike_condition_t condition, bool enable);
451
452 /**
453 * Check if a condition flag is set.
454 *
455 * @param condition condition to check
456 * @return TRUE if condition flag set, FALSE otherwise
457 */
458 bool (*has_condition) (ike_sa_t *this, ike_condition_t condition);
459
460 /**
461 * Get the number of queued MOBIKE address updates.
462 *
463 * @return number of pending updates
464 */
465 u_int32_t (*get_pending_updates)(ike_sa_t *this);
466
467 /**
468 * Set the number of queued MOBIKE address updates.
469 *
470 * @param updates number of pending updates
471 */
472 void (*set_pending_updates)(ike_sa_t *this, u_int32_t updates);
473
474 /**
475 * Check if we are the original initiator of this IKE_SA (rekeying does not
476 * change this flag).
477 */
478 bool (*is_ike_initiator)(ike_sa_t *this);
479
480
481 #ifdef ME
482 /**
483 * Activate mediation server functionality for this IKE_SA.
484 */
485 void (*act_as_mediation_server) (ike_sa_t *this);
486
487 /**
488 * Get the server reflexive host.
489 *
490 * @return server reflexive host
491 */
492 host_t* (*get_server_reflexive_host) (ike_sa_t *this);
493
494 /**
495 * Set the server reflexive host.
496 *
497 * @param host server reflexive host
498 */
499 void (*set_server_reflexive_host) (ike_sa_t *this, host_t *host);
500
501 /**
502 * Get the connect ID.
503 *
504 * @return connect ID
505 */
506 chunk_t (*get_connect_id) (ike_sa_t *this);
507
508 /**
509 * Initiate the mediation of a mediated connection (i.e. initiate a
510 * ME_CONNECT exchange).
511 *
512 * @param mediated_cfg peer_cfg of the mediated connection
513 * @return
514 * - SUCCESS if initialization started
515 * - DESTROY_ME if initialization failed
516 */
517 status_t (*initiate_mediation) (ike_sa_t *this, peer_cfg_t *mediated_cfg);
518
519 /**
520 * Initiate the mediated connection
521 *
522 * @param me local endpoint (gets cloned)
523 * @param other remote endpoint (gets cloned)
524 * @param connect_id connect ID (gets cloned)
525 * @return
526 * - SUCCESS if initialization started
527 * - DESTROY_ME if initialization failed
528 */
529 status_t (*initiate_mediated) (ike_sa_t *this, host_t *me, host_t *other,
530 chunk_t connect_id);
531
532 /**
533 * Relay data from one peer to another (i.e. initiate a
534 * ME_CONNECT exchange).
535 *
536 * Data is cloned.
537 *
538 * @param requester ID of the requesting peer
539 * @param connect_id data of the ME_CONNECTID payload
540 * @param connect_key data of the ME_CONNECTKEY payload
541 * @param endpoints endpoints
542 * @param response TRUE if this is a response
543 * @return
544 * - SUCCESS if relay started
545 * - DESTROY_ME if relay failed
546 */
547 status_t (*relay) (ike_sa_t *this, identification_t *requester, chunk_t connect_id,
548 chunk_t connect_key, linked_list_t *endpoints, bool response);
549
550 /**
551 * Send a callback to a peer.
552 *
553 * Data is cloned.
554 *
555 * @param peer_id ID of the other peer
556 * @return
557 * - SUCCESS if response started
558 * - DESTROY_ME if response failed
559 */
560 status_t (*callback) (ike_sa_t *this, identification_t *peer_id);
561
562 /**
563 * Respond to a ME_CONNECT request.
564 *
565 * Data is cloned.
566 *
567 * @param peer_id ID of the other peer
568 * @param connect_id the connect ID supplied by the initiator
569 * @return
570 * - SUCCESS if response started
571 * - DESTROY_ME if response failed
572 */
573 status_t (*respond) (ike_sa_t *this, identification_t *peer_id, chunk_t connect_id);
574 #endif /* ME */
575
576 /**
577 * Initiate a new connection.
578 *
579 * The configs are owned by the IKE_SA after the call.
580 *
581 * @param child_cfg child config to create CHILD from
582 * @return
583 * - SUCCESS if initialization started
584 * - DESTROY_ME if initialization failed
585 */
586 status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg);
587
588 /**
589 * Route a policy in the kernel.
590 *
591 * Installs the policies in the kernel. If traffic matches,
592 * the kernel requests connection setup from the IKE_SA via acquire().
593 *
594 * @param child_cfg child config to route
595 * @return
596 * - SUCCESS if routed successfully
597 * - FAILED if routing failed
598 */
599 status_t (*route) (ike_sa_t *this, child_cfg_t *child_cfg);
600
601 /**
602 * Unroute a policy in the kernel previously routed.
603 *
604 * @param reqid reqid of CHILD_SA to unroute
605 * @return
606 * - SUCCESS if route removed
607 * - NOT_FOUND if CHILD_SA not found
608 * - DESTROY_ME if last CHILD_SA was unrouted
609 */
610 status_t (*unroute) (ike_sa_t *this, u_int32_t reqid);
611
612 /**
613 * Acquire connection setup for an installed kernel policy.
614 *
615 * If an installed policy raises an acquire, the kernel calls
616 * this function to establish the CHILD_SA (and maybe the IKE_SA).
617 *
618 * @param reqid reqid of the CHILD_SA the policy belongs to.
619 * @return
620 * - SUCCESS if initialization started
621 * - DESTROY_ME if initialization failed
622 */
623 status_t (*acquire) (ike_sa_t *this, u_int32_t reqid);
624
625 /**
626 * Initiates the deletion of an IKE_SA.
627 *
628 * Sends a delete message to the remote peer and waits for
629 * its response. If the response comes in, or a timeout occurs,
630 * the IKE SA gets deleted.
631 *
632 * @return
633 * - SUCCESS if deletion is initialized
634 * - INVALID_STATE, if the IKE_SA is not in
635 * an established state and can not be
636 * delete (but destroyed).
637 */
638 status_t (*delete) (ike_sa_t *this);
639
640 /**
641 * Update IKE_SAs after network interfaces have changed.
642 *
643 * Whenever the network interface configuration changes, the kernel
644 * interface calls roam() on each IKE_SA. The IKE_SA then checks if
645 * the new network config requires changes, and handles appropriate.
646 * If MOBIKE is supported, addresses are updated; If not, the tunnel is
647 * restarted.
648 *
649 * @param address TRUE if address list changed, FALSE otherwise
650 * @return SUCCESS, FAILED, DESTROY_ME
651 */
652 status_t (*roam)(ike_sa_t *this, bool address);
653
654 /**
655 * Processes a incoming IKEv2-Message.
656 *
657 * Message processing may fail. If a critical failure occurs,
658 * process_message() return DESTROY_ME. Then the caller must
659 * destroy the IKE_SA immediatly, as it is unusable.
660 *
661 * @param message message to process
662 * @return
663 * - SUCCESS
664 * - FAILED
665 * - DESTROY_ME if this IKE_SA MUST be deleted
666 */
667 status_t (*process_message) (ike_sa_t *this, message_t *message);
668
669 /**
670 * Generate a IKE message to send it to the peer.
671 *
672 * This method generates all payloads in the message and encrypts/signs
673 * the packet.
674 *
675 * @param message message to generate
676 * @param packet generated output packet
677 * @return
678 * - SUCCESS
679 * - FAILED
680 * - DESTROY_ME if this IKE_SA MUST be deleted
681 */
682 status_t (*generate_message) (ike_sa_t *this, message_t *message,
683 packet_t **packet);
684
685 /**
686 * Retransmits a request.
687 *
688 * @param message_id ID of the request to retransmit
689 * @return
690 * - SUCCESS
691 * - NOT_FOUND if request doesn't have to be retransmited
692 */
693 status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
694
695 /**
696 * Sends a DPD request to the peer.
697 *
698 * To check if a peer is still alive, periodic
699 * empty INFORMATIONAL messages are sent if no
700 * other traffic was received.
701 *
702 * @return
703 * - SUCCESS
704 * - DESTROY_ME, if peer did not respond
705 */
706 status_t (*send_dpd) (ike_sa_t *this);
707
708 /**
709 * Sends a keep alive packet.
710 *
711 * To refresh NAT tables in a NAT router
712 * between the peers, periodic empty
713 * UDP packets are sent if no other traffic
714 * was sent.
715 */
716 void (*send_keepalive) (ike_sa_t *this);
717
718 /**
719 * Derive all keys and create the transforms for IKE communication.
720 *
721 * Keys are derived using the diffie hellman secret, nonces and internal
722 * stored SPIs.
723 * Key derivation differs when an IKE_SA is set up to replace an
724 * existing IKE_SA (rekeying). The SK_d key from the old IKE_SA
725 * is included in the derivation process.
726 *
727 * @param proposal proposal which contains algorithms to use
728 * @param secret secret derived from DH exchange, gets freed
729 * @param nonce_i initiators nonce
730 * @param nonce_r responders nonce
731 * @param initiator TRUE if initiator, FALSE otherwise
732 * @param child_prf PRF with SK_d key when rekeying, NULL otherwise
733 * @param old_prf general purpose PRF of old SA when rekeying
734 */
735 status_t (*derive_keys)(ike_sa_t *this, proposal_t* proposal, chunk_t secret,
736 chunk_t nonce_i, chunk_t nonce_r,
737 bool initiator, prf_t *child_prf, prf_t *old_prf);
738
739 /**
740 * Get the selected IKE proposal
741 *
742 * @return selected IKE proposal
743 */
744 proposal_t* (*get_proposal)(ike_sa_t *this);
745
746 /**
747 * Get a multi purpose prf for the negotiated PRF function.
748 *
749 * @return pointer to prf_t object
750 */
751 prf_t *(*get_prf) (ike_sa_t *this);
752
753 /**
754 * Get the prf-object, which is used to derive keys for child SAs.
755 *
756 * @return pointer to prf_t object
757 */
758 prf_t *(*get_child_prf) (ike_sa_t *this);
759
760 /**
761 * Get the key to build outgoing authentication data.
762 *
763 * @return pointer to prf_t object
764 */
765 chunk_t (*get_skp_build) (ike_sa_t *this);
766
767 /**
768 * Get the key to verify incoming authentication data.
769 *
770 * @return pointer to prf_t object
771 */
772 chunk_t (*get_skp_verify) (ike_sa_t *this);
773
774 /**
775 * Associates a child SA to this IKE SA
776 *
777 * @param child_sa child_sa to add
778 */
779 void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
780
781 /**
782 * Get a CHILD_SA identified by protocol and SPI.
783 *
784 * @param protocol protocol of the SA
785 * @param spi SPI of the CHILD_SA
786 * @param inbound TRUE if SPI is inbound, FALSE if outbound
787 * @return child_sa, or NULL if none found
788 */
789 child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
790 u_int32_t spi, bool inbound);
791
792 /**
793 * Create an iterator over all CHILD_SAs.
794 *
795 * @return iterator
796 */
797 iterator_t* (*create_child_sa_iterator) (ike_sa_t *this);
798
799 /**
800 * Rekey the CHILD SA with the specified reqid.
801 *
802 * Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
803 *
804 * @param protocol protocol of the SA
805 * @param spi inbound SPI of the CHILD_SA
806 * @return
807 * - NOT_FOUND, if IKE_SA has no such CHILD_SA
808 * - SUCCESS, if rekeying initiated
809 */
810 status_t (*rekey_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
811
812 /**
813 * Close the CHILD SA with the specified protocol/SPI.
814 *
815 * Looks for a CHILD SA owned by this IKE_SA, deletes it and
816 * notify's the remote peer about the delete. The associated
817 * states and policies in the kernel get deleted, if they exist.
818 *
819 * @param protocol protocol of the SA
820 * @param spi inbound SPI of the CHILD_SA
821 * @return
822 * - NOT_FOUND, if IKE_SA has no such CHILD_SA
823 * - SUCCESS, if delete message sent
824 */
825 status_t (*delete_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
826
827 /**
828 * Destroy a CHILD SA with the specified protocol/SPI.
829 *
830 * Looks for a CHILD SA owned by this IKE_SA and destroys it.
831 *
832 * @param protocol protocol of the SA
833 * @param spi inbound SPI of the CHILD_SA
834 * @return
835 * - NOT_FOUND, if IKE_SA has no such CHILD_SA
836 * - SUCCESS
837 */
838 status_t (*destroy_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
839
840 /**
841 * Rekey the IKE_SA.
842 *
843 * Sets up a new IKE_SA, moves all CHILDs to it and deletes this IKE_SA.
844 *
845 * @return - SUCCESS, if IKE_SA rekeying initiated
846 */
847 status_t (*rekey) (ike_sa_t *this);
848
849 /**
850 * Reauthenticate the IKE_SA.
851 *
852 * Create a completely new IKE_SA with authentication, recreates all children
853 * within the IKE_SA, closes this IKE_SA.
854 *
855 * @return DESTROY_ME to destroy the IKE_SA
856 */
857 status_t (*reauth) (ike_sa_t *this);
858
859 /**
860 * Restablish the IKE_SA.
861 *
862 * Reestablish an IKE_SA after it has been closed.
863 *
864 * @return DESTROY_ME to destroy the IKE_SA
865 */
866 status_t (*reestablish) (ike_sa_t *this);
867
868 /**
869 * Set the lifetime limit received from a AUTH_LIFETIME notify.
870 *
871 * @param lifetime lifetime in seconds
872 */
873 void (*set_auth_lifetime)(ike_sa_t *this, u_int32_t lifetime);
874
875 /**
876 * Set the virtual IP to use for this IKE_SA and its children.
877 *
878 * The virtual IP is assigned per IKE_SA, not per CHILD_SA. It has the same
879 * lifetime as the IKE_SA.
880 *
881 * @param local TRUE to set local address, FALSE for remote
882 * @param ip IP to set as virtual IP
883 */
884 void (*set_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
885
886 /**
887 * Get the virtual IP configured.
888 *
889 * @param local TRUE to get local virtual IP, FALSE for remote
890 * @return host_t *virtual IP
891 */
892 host_t* (*get_virtual_ip) (ike_sa_t *this, bool local);
893
894 /**
895 * Add a DNS server to the system.
896 *
897 * An IRAS may send a DNS server. To use it, it is installed on the
898 * system. The DNS entry has a lifetime until the IKE_SA gets closed.
899 *
900 * @param dns DNS server to install on the system
901 */
902 void (*add_dns_server) (ike_sa_t *this, host_t *dns);
903
904 /**
905 * Inherit all attributes of other to this after rekeying.
906 *
907 * When rekeying is completed, all CHILD_SAs, the virtual IP and all
908 * outstanding tasks are moved from other to this.
909 * As this call may initiate inherited tasks, a status is returned.
910 *
911 * @param other other task to inherit from
912 * @return DESTROY_ME if initiation of inherited task failed
913 */
914 status_t (*inherit) (ike_sa_t *this, ike_sa_t *other);
915
916 /**
917 * Reset the IKE_SA, useable when initiating fails
918 */
919 void (*reset) (ike_sa_t *this);
920
921 /**
922 * Destroys a ike_sa_t object.
923 */
924 void (*destroy) (ike_sa_t *this);
925 };
926
927 /**
928 * Creates an ike_sa_t object with a specific ID.
929 *
930 * @param ike_sa_id ike_sa_id_t object to associate with new IKE_SA
931 * @return ike_sa_t object
932 */
933 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id);
934
935 #endif /* IKE_SA_H_ @} */
strongSwan - IPsec VPN