updated API doc for socket.h
[strongswan.git] / src / charon / sa / ike_sa.h
1 /*
2 * Copyright (C) 2006-2008 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2008 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 *
18 * $Id$
19 */
20
21 /**
22 * @defgroup ike_sa ike_sa
23 * @{ @ingroup sa
24 */
25
26 #ifndef IKE_SA_H_
27 #define IKE_SA_H_
28
29 typedef enum ike_extension_t ike_extension_t;
30 typedef enum ike_condition_t ike_condition_t;
31 typedef enum ike_sa_state_t ike_sa_state_t;
32 typedef enum statistic_t statistic_t;
33 typedef struct ike_sa_t ike_sa_t;
34
35 #include <library.h>
36 #include <encoding/message.h>
37 #include <encoding/payloads/proposal_substructure.h>
38 #include <sa/ike_sa_id.h>
39 #include <sa/child_sa.h>
40 #include <sa/tasks/task.h>
41 #include <sa/keymat.h>
42 #include <config/peer_cfg.h>
43 #include <config/ike_cfg.h>
44 #include <credentials/auth_info.h>
45
46 /**
47 * Timeout in milliseconds after that a half open IKE_SA gets deleted.
48 */
49 #define HALF_OPEN_IKE_SA_TIMEOUT 30000
50
51 /**
52 * Interval to send keepalives when NATed, in seconds.
53 */
54 #define KEEPALIVE_INTERVAL 20
55
56 /**
57 * After which time rekeying should be retried if it failed, in seconds.
58 */
59 #define RETRY_INTERVAL 30
60
61 /**
62 * Jitter to subtract from RETRY_INTERVAL to randomize rekey retry.
63 */
64 #define RETRY_JITTER 20
65
66 /**
67 * Extensions (or optional features) the peer supports
68 */
69 enum ike_extension_t {
70
71 /**
72 * peer supports NAT traversal as specified in RFC4306
73 */
74 EXT_NATT = (1<<0),
75
76 /**
77 * peer supports MOBIKE (RFC4555)
78 */
79 EXT_MOBIKE = (1<<1),
80
81 /**
82 * peer supports HTTP cert lookups as specified in RFC4306
83 */
84 EXT_HASH_AND_URL = (1<<2),
85 };
86
87 /**
88 * Conditions of an IKE_SA, change during its lifetime
89 */
90 enum ike_condition_t {
91
92 /**
93 * Connection is natted (or faked) somewhere
94 */
95 COND_NAT_ANY = (1<<0),
96
97 /**
98 * we are behind NAT
99 */
100 COND_NAT_HERE = (1<<1),
101
102 /**
103 * other is behind NAT
104 */
105 COND_NAT_THERE = (1<<2),
106
107 /**
108 * Faking NAT to enforce UDP encapsulation
109 */
110 COND_NAT_FAKE = (1<<3),
111
112 /**
113 * peer has ben authenticated using EAP
114 */
115 COND_EAP_AUTHENTICATED = (1<<4),
116
117 /**
118 * received a certificate request from the peer
119 */
120 COND_CERTREQ_SEEN = (1<<5),
121
122 /**
123 * Local peer is the "original" IKE initiator. Unaffected from rekeying.
124 */
125 COND_ORIGINAL_INITIATOR = (1<<6),
126 };
127
128 /**
129 * Timing information and statistics to query from an SA
130 */
131 enum statistic_t {
132 /** Timestamp of SA establishement */
133 STAT_ESTABLISHED = 0,
134 /** Timestamp of scheudled rekeying */
135 STAT_REKEY,
136 /** Timestamp of scheudled reauthentication */
137 STAT_REAUTH,
138 /** Timestamp of scheudled delete */
139 STAT_DELETE,
140 /** Timestamp of last inbound IKE packet */
141 STAT_INBOUND,
142 /** Timestamp of last outbound IKE packet */
143 STAT_OUTBOUND,
144
145 STAT_MAX
146 };
147
148 /**
149 * State of an IKE_SA.
150 *
151 * An IKE_SA passes various states in its lifetime. A newly created
152 * SA is in the state CREATED.
153 * @verbatim
154 +----------------+
155 ¦ SA_CREATED ¦
156 +----------------+
157 ¦
158 on initiate()---> ¦ <----- on IKE_SA_INIT received
159 V
160 +----------------+
161 ¦ SA_CONNECTING ¦
162 +----------------+
163 ¦
164 ¦ <----- on IKE_AUTH successfully completed
165 V
166 +----------------+
167 ¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
168 +----------------+ ¦
169 ¦ V
170 on delete()---> ¦ <----- on IKE_SA +-------------+
171 ¦ delete request ¦ SA_REKEYING ¦
172 ¦ received +-------------+
173 V ¦
174 +----------------+ ¦
175 ¦ SA_DELETING ¦<------------------------+ <-- after rekeying
176 +----------------+
177 ¦
178 ¦ <----- after delete() acknowledged
179 ¦
180 \V/
181 X
182 / \
183 @endverbatim
184 */
185 enum ike_sa_state_t {
186
187 /**
188 * IKE_SA just got created, but is not initiating nor responding yet.
189 */
190 IKE_CREATED,
191
192 /**
193 * IKE_SA gets initiated actively or passively
194 */
195 IKE_CONNECTING,
196
197 /**
198 * IKE_SA is fully established
199 */
200 IKE_ESTABLISHED,
201
202 /**
203 * IKE_SA rekeying in progress
204 */
205 IKE_REKEYING,
206
207 /**
208 * IKE_SA is in progress of deletion
209 */
210 IKE_DELETING,
211
212 /**
213 * IKE_SA object gets destroyed
214 */
215 IKE_DESTROYING,
216 };
217
218 /**
219 * enum names for ike_sa_state_t.
220 */
221 extern enum_name_t *ike_sa_state_names;
222
223 /**
224 * Class ike_sa_t representing an IKE_SA.
225 *
226 * An IKE_SA contains crypto information related to a connection
227 * with a peer. It contains multiple IPsec CHILD_SA, for which
228 * it is responsible. All traffic is handled by an IKE_SA, using
229 * the task manager and its tasks.
230 */
231 struct ike_sa_t {
232
233 /**
234 * Get the id of the SA.
235 *
236 * Returned ike_sa_id_t object is not getting cloned!
237 *
238 * @return ike_sa's ike_sa_id_t
239 */
240 ike_sa_id_t* (*get_id) (ike_sa_t *this);
241
242 /**
243 * Get the numerical ID uniquely defining this IKE_SA.
244 *
245 * @return unique ID
246 */
247 u_int32_t (*get_unique_id) (ike_sa_t *this);
248
249 /**
250 * Get the state of the IKE_SA.
251 *
252 * @return state of the IKE_SA
253 */
254 ike_sa_state_t (*get_state) (ike_sa_t *this);
255
256 /**
257 * Set the state of the IKE_SA.
258 *
259 * @param state state to set for the IKE_SA
260 */
261 void (*set_state) (ike_sa_t *this, ike_sa_state_t ike_sa);
262
263 /**
264 * Get the name of the connection this IKE_SA uses.
265 *
266 * @return name
267 */
268 char* (*get_name) (ike_sa_t *this);
269
270 /**
271 * Get statistic values from the IKE_SA.
272 *
273 * @param kind kind of requested value
274 * @return value as integer
275 */
276 u_int32_t (*get_statistic)(ike_sa_t *this, statistic_t kind);
277
278 /**
279 * Get the own host address.
280 *
281 * @return host address
282 */
283 host_t* (*get_my_host) (ike_sa_t *this);
284
285 /**
286 * Set the own host address.
287 *
288 * @param me host address
289 */
290 void (*set_my_host) (ike_sa_t *this, host_t *me);
291
292 /**
293 * Get the other peers host address.
294 *
295 * @return host address
296 */
297 host_t* (*get_other_host) (ike_sa_t *this);
298
299 /**
300 * Set the others host address.
301 *
302 * @param other host address
303 */
304 void (*set_other_host) (ike_sa_t *this, host_t *other);
305
306 /**
307 * Update the IKE_SAs host.
308 *
309 * Hosts may be NULL to use current host.
310 *
311 * @param me new local host address, or NULL
312 * @param other new remote host address, or NULL
313 */
314 void (*update_hosts)(ike_sa_t *this, host_t *me, host_t *other);
315
316 /**
317 * Get the own identification.
318 *
319 * @return identification
320 */
321 identification_t* (*get_my_id) (ike_sa_t *this);
322
323 /**
324 * Set the own identification.
325 *
326 * @param me identification
327 */
328 void (*set_my_id) (ike_sa_t *this, identification_t *me);
329
330 /**
331 * Get the other peer's identification.
332 *
333 * @return identification
334 */
335 identification_t* (*get_other_id) (ike_sa_t *this);
336
337 /**
338 * Set the other peer's identification.
339 *
340 * @param other identification
341 */
342 void (*set_other_id) (ike_sa_t *this, identification_t *other);
343
344 /**
345 * Get the peers EAP identity.
346 *
347 * The EAP identity is exchanged in a EAP-Identity exchange.
348 *
349 * @return identification, NULL if none set
350 */
351 identification_t* (*get_eap_identity) (ike_sa_t *this);
352
353 /**
354 * Set the peer's EAP identity.
355 *
356 * @param id identification
357 */
358 void (*set_eap_identity) (ike_sa_t *this, identification_t *id);
359
360 /**
361 * Get the config used to setup this IKE_SA.
362 *
363 * @return ike_config
364 */
365 ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
366
367 /**
368 * Set the config to setup this IKE_SA.
369 *
370 * @param config ike_config to use
371 */
372 void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
373
374 /**
375 * Get the peer config used by this IKE_SA.
376 *
377 * @return peer_config
378 */
379 peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
380
381 /**
382 * Set the peer config to use with this IKE_SA.
383 *
384 * @param config peer_config to use
385 */
386 void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
387
388 /**
389 * Get authentication/authorization info for local peer.
390 *
391 * @return auth_info for me
392 */
393 auth_info_t* (*get_my_auth)(ike_sa_t *this);
394
395 /**
396 * Get authentication/authorization info for remote peer.
397 *
398 * @return auth_info for me
399 */
400 auth_info_t* (*get_other_auth)(ike_sa_t *this);
401
402 /**
403 * Get the selected proposal of this IKE_SA.
404 *
405 * @return selected proposal
406 */
407 proposal_t* (*get_proposal)(ike_sa_t *this);
408
409 /**
410 * Set the proposal selected for this IKE_SA.
411 *
412 * @param selected proposal
413 */
414 void (*set_proposal)(ike_sa_t *this, proposal_t *proposal);
415
416 /**
417 * Add an additional address for the peer.
418 *
419 * In MOBIKE, a peer may transmit additional addresses where it is
420 * reachable. These are stored in the IKE_SA.
421 * The own list of addresses is not stored, they are queried from
422 * the kernel when required.
423 *
424 * @param host host to add to list
425 */
426 void (*add_additional_address)(ike_sa_t *this, host_t *host);
427
428 /**
429 * Create an iterator over all additional addresses of the peer.
430 *
431 * @return iterator over addresses
432 */
433 iterator_t* (*create_additional_address_iterator)(ike_sa_t *this);
434
435 /**
436 * Check if mappings have changed on a NAT for our source address.
437 *
438 * @param hash received DESTINATION_IP hash
439 * @return TRUE if mappings have changed
440 */
441 bool (*has_mapping_changed)(ike_sa_t *this, chunk_t hash);
442
443 /**
444 * Enable an extension the peer supports.
445 *
446 * If support for an IKE extension is detected, this method is called
447 * to enable that extension and behave accordingly.
448 *
449 * @param extension extension to enable
450 */
451 void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
452
453 /**
454 * Check if the peer supports an extension.
455 *
456 * @param extension extension to check for support
457 * @return TRUE if peer supports it, FALSE otherwise
458 */
459 bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
460
461 /**
462 * Enable/disable a condition flag for this IKE_SA.
463 *
464 * @param condition condition to enable/disable
465 * @param enable TRUE to enable condition, FALSE to disable
466 */
467 void (*set_condition) (ike_sa_t *this, ike_condition_t condition, bool enable);
468
469 /**
470 * Check if a condition flag is set.
471 *
472 * @param condition condition to check
473 * @return TRUE if condition flag set, FALSE otherwise
474 */
475 bool (*has_condition) (ike_sa_t *this, ike_condition_t condition);
476
477 /**
478 * Get the number of queued MOBIKE address updates.
479 *
480 * @return number of pending updates
481 */
482 u_int32_t (*get_pending_updates)(ike_sa_t *this);
483
484 /**
485 * Set the number of queued MOBIKE address updates.
486 *
487 * @param updates number of pending updates
488 */
489 void (*set_pending_updates)(ike_sa_t *this, u_int32_t updates);
490
491 #ifdef ME
492 /**
493 * Activate mediation server functionality for this IKE_SA.
494 */
495 void (*act_as_mediation_server) (ike_sa_t *this);
496
497 /**
498 * Get the server reflexive host.
499 *
500 * @return server reflexive host
501 */
502 host_t* (*get_server_reflexive_host) (ike_sa_t *this);
503
504 /**
505 * Set the server reflexive host.
506 *
507 * @param host server reflexive host
508 */
509 void (*set_server_reflexive_host) (ike_sa_t *this, host_t *host);
510
511 /**
512 * Get the connect ID.
513 *
514 * @return connect ID
515 */
516 chunk_t (*get_connect_id) (ike_sa_t *this);
517
518 /**
519 * Initiate the mediation of a mediated connection (i.e. initiate a
520 * ME_CONNECT exchange).
521 *
522 * @param mediated_cfg peer_cfg of the mediated connection
523 * @return
524 * - SUCCESS if initialization started
525 * - DESTROY_ME if initialization failed
526 */
527 status_t (*initiate_mediation) (ike_sa_t *this, peer_cfg_t *mediated_cfg);
528
529 /**
530 * Initiate the mediated connection
531 *
532 * @param me local endpoint (gets cloned)
533 * @param other remote endpoint (gets cloned)
534 * @param connect_id connect ID (gets cloned)
535 * @return
536 * - SUCCESS if initialization started
537 * - DESTROY_ME if initialization failed
538 */
539 status_t (*initiate_mediated) (ike_sa_t *this, host_t *me, host_t *other,
540 chunk_t connect_id);
541
542 /**
543 * Relay data from one peer to another (i.e. initiate a
544 * ME_CONNECT exchange).
545 *
546 * Data is cloned.
547 *
548 * @param requester ID of the requesting peer
549 * @param connect_id data of the ME_CONNECTID payload
550 * @param connect_key data of the ME_CONNECTKEY payload
551 * @param endpoints endpoints
552 * @param response TRUE if this is a response
553 * @return
554 * - SUCCESS if relay started
555 * - DESTROY_ME if relay failed
556 */
557 status_t (*relay) (ike_sa_t *this, identification_t *requester, chunk_t connect_id,
558 chunk_t connect_key, linked_list_t *endpoints, bool response);
559
560 /**
561 * Send a callback to a peer.
562 *
563 * Data is cloned.
564 *
565 * @param peer_id ID of the other peer
566 * @return
567 * - SUCCESS if response started
568 * - DESTROY_ME if response failed
569 */
570 status_t (*callback) (ike_sa_t *this, identification_t *peer_id);
571
572 /**
573 * Respond to a ME_CONNECT request.
574 *
575 * Data is cloned.
576 *
577 * @param peer_id ID of the other peer
578 * @param connect_id the connect ID supplied by the initiator
579 * @return
580 * - SUCCESS if response started
581 * - DESTROY_ME if response failed
582 */
583 status_t (*respond) (ike_sa_t *this, identification_t *peer_id, chunk_t connect_id);
584 #endif /* ME */
585
586 /**
587 * Initiate a new connection.
588 *
589 * The configs are owned by the IKE_SA after the call.
590 *
591 * @param child_cfg child config to create CHILD from
592 * @return
593 * - SUCCESS if initialization started
594 * - DESTROY_ME if initialization failed
595 */
596 status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg);
597
598 /**
599 * Route a policy in the kernel.
600 *
601 * Installs the policies in the kernel. If traffic matches,
602 * the kernel requests connection setup from the IKE_SA via acquire().
603 *
604 * @param child_cfg child config to route
605 * @return
606 * - SUCCESS if routed successfully
607 * - FAILED if routing failed
608 */
609 status_t (*route) (ike_sa_t *this, child_cfg_t *child_cfg);
610
611 /**
612 * Unroute a policy in the kernel previously routed.
613 *
614 * @param reqid reqid of CHILD_SA to unroute
615 * @return
616 * - SUCCESS if route removed
617 * - NOT_FOUND if CHILD_SA not found
618 * - DESTROY_ME if last CHILD_SA was unrouted
619 */
620 status_t (*unroute) (ike_sa_t *this, u_int32_t reqid);
621
622 /**
623 * Acquire connection setup for an installed kernel policy.
624 *
625 * If an installed policy raises an acquire, the kernel calls
626 * this function to establish the CHILD_SA (and maybe the IKE_SA).
627 *
628 * @param reqid reqid of the CHILD_SA the policy belongs to.
629 * @return
630 * - SUCCESS if initialization started
631 * - DESTROY_ME if initialization failed
632 */
633 status_t (*acquire) (ike_sa_t *this, u_int32_t reqid);
634
635 /**
636 * Initiates the deletion of an IKE_SA.
637 *
638 * Sends a delete message to the remote peer and waits for
639 * its response. If the response comes in, or a timeout occurs,
640 * the IKE SA gets deleted.
641 *
642 * @return
643 * - SUCCESS if deletion is initialized
644 * - INVALID_STATE, if the IKE_SA is not in
645 * an established state and can not be
646 * delete (but destroyed).
647 */
648 status_t (*delete) (ike_sa_t *this);
649
650 /**
651 * Update IKE_SAs after network interfaces have changed.
652 *
653 * Whenever the network interface configuration changes, the kernel
654 * interface calls roam() on each IKE_SA. The IKE_SA then checks if
655 * the new network config requires changes, and handles appropriate.
656 * If MOBIKE is supported, addresses are updated; If not, the tunnel is
657 * restarted.
658 *
659 * @param address TRUE if address list changed, FALSE otherwise
660 * @return SUCCESS, FAILED, DESTROY_ME
661 */
662 status_t (*roam)(ike_sa_t *this, bool address);
663
664 /**
665 * Processes a incoming IKEv2-Message.
666 *
667 * Message processing may fail. If a critical failure occurs,
668 * process_message() return DESTROY_ME. Then the caller must
669 * destroy the IKE_SA immediatly, as it is unusable.
670 *
671 * @param message message to process
672 * @return
673 * - SUCCESS
674 * - FAILED
675 * - DESTROY_ME if this IKE_SA MUST be deleted
676 */
677 status_t (*process_message) (ike_sa_t *this, message_t *message);
678
679 /**
680 * Generate a IKE message to send it to the peer.
681 *
682 * This method generates all payloads in the message and encrypts/signs
683 * the packet.
684 *
685 * @param message message to generate
686 * @param packet generated output packet
687 * @return
688 * - SUCCESS
689 * - FAILED
690 * - DESTROY_ME if this IKE_SA MUST be deleted
691 */
692 status_t (*generate_message) (ike_sa_t *this, message_t *message,
693 packet_t **packet);
694
695 /**
696 * Retransmits a request.
697 *
698 * @param message_id ID of the request to retransmit
699 * @return
700 * - SUCCESS
701 * - NOT_FOUND if request doesn't have to be retransmited
702 */
703 status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
704
705 /**
706 * Sends a DPD request to the peer.
707 *
708 * To check if a peer is still alive, periodic
709 * empty INFORMATIONAL messages are sent if no
710 * other traffic was received.
711 *
712 * @return
713 * - SUCCESS
714 * - DESTROY_ME, if peer did not respond
715 */
716 status_t (*send_dpd) (ike_sa_t *this);
717
718 /**
719 * Sends a keep alive packet.
720 *
721 * To refresh NAT tables in a NAT router
722 * between the peers, periodic empty
723 * UDP packets are sent if no other traffic
724 * was sent.
725 */
726 void (*send_keepalive) (ike_sa_t *this);
727
728 /**
729 * Get the keying material of this IKE_SA.
730 *
731 * @return per IKE_SA keymat instance
732 */
733 keymat_t* (*get_keymat)(ike_sa_t *this);
734
735 /**
736 * Associates a child SA to this IKE SA
737 *
738 * @param child_sa child_sa to add
739 */
740 void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
741
742 /**
743 * Get a CHILD_SA identified by protocol and SPI.
744 *
745 * @param protocol protocol of the SA
746 * @param spi SPI of the CHILD_SA
747 * @param inbound TRUE if SPI is inbound, FALSE if outbound
748 * @return child_sa, or NULL if none found
749 */
750 child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
751 u_int32_t spi, bool inbound);
752
753 /**
754 * Create an iterator over all CHILD_SAs.
755 *
756 * @return iterator
757 */
758 iterator_t* (*create_child_sa_iterator) (ike_sa_t *this);
759
760 /**
761 * Rekey the CHILD SA with the specified reqid.
762 *
763 * Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
764 *
765 * @param protocol protocol of the SA
766 * @param spi inbound SPI of the CHILD_SA
767 * @return
768 * - NOT_FOUND, if IKE_SA has no such CHILD_SA
769 * - SUCCESS, if rekeying initiated
770 */
771 status_t (*rekey_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
772
773 /**
774 * Close the CHILD SA with the specified protocol/SPI.
775 *
776 * Looks for a CHILD SA owned by this IKE_SA, deletes it and
777 * notify's the remote peer about the delete. The associated
778 * states and policies in the kernel get deleted, if they exist.
779 *
780 * @param protocol protocol of the SA
781 * @param spi inbound SPI of the CHILD_SA
782 * @return
783 * - NOT_FOUND, if IKE_SA has no such CHILD_SA
784 * - SUCCESS, if delete message sent
785 */
786 status_t (*delete_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
787
788 /**
789 * Destroy a CHILD SA with the specified protocol/SPI.
790 *
791 * Looks for a CHILD SA owned by this IKE_SA and destroys it.
792 *
793 * @param protocol protocol of the SA
794 * @param spi inbound SPI of the CHILD_SA
795 * @return
796 * - NOT_FOUND, if IKE_SA has no such CHILD_SA
797 * - SUCCESS
798 */
799 status_t (*destroy_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
800
801 /**
802 * Rekey the IKE_SA.
803 *
804 * Sets up a new IKE_SA, moves all CHILDs to it and deletes this IKE_SA.
805 *
806 * @return - SUCCESS, if IKE_SA rekeying initiated
807 */
808 status_t (*rekey) (ike_sa_t *this);
809
810 /**
811 * Reauthenticate the IKE_SA.
812 *
813 * Create a completely new IKE_SA with authentication, recreates all children
814 * within the IKE_SA, closes this IKE_SA.
815 *
816 * @return DESTROY_ME to destroy the IKE_SA
817 */
818 status_t (*reauth) (ike_sa_t *this);
819
820 /**
821 * Restablish the IKE_SA.
822 *
823 * Reestablish an IKE_SA after it has been closed.
824 *
825 * @return DESTROY_ME to destroy the IKE_SA
826 */
827 status_t (*reestablish) (ike_sa_t *this);
828
829 /**
830 * Set the lifetime limit received from a AUTH_LIFETIME notify.
831 *
832 * @param lifetime lifetime in seconds
833 */
834 void (*set_auth_lifetime)(ike_sa_t *this, u_int32_t lifetime);
835
836 /**
837 * Set the virtual IP to use for this IKE_SA and its children.
838 *
839 * The virtual IP is assigned per IKE_SA, not per CHILD_SA. It has the same
840 * lifetime as the IKE_SA.
841 *
842 * @param local TRUE to set local address, FALSE for remote
843 * @param ip IP to set as virtual IP
844 */
845 void (*set_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
846
847 /**
848 * Get the virtual IP configured.
849 *
850 * @param local TRUE to get local virtual IP, FALSE for remote
851 * @return host_t *virtual IP
852 */
853 host_t* (*get_virtual_ip) (ike_sa_t *this, bool local);
854
855 /**
856 * Add a DNS server to the system.
857 *
858 * An IRAS may send a DNS server. To use it, it is installed on the
859 * system. The DNS entry has a lifetime until the IKE_SA gets closed.
860 *
861 * @param dns DNS server to install on the system
862 */
863 void (*add_dns_server) (ike_sa_t *this, host_t *dns);
864
865 /**
866 * Set local and remote host addresses to be used for IKE.
867 *
868 * These addresses are communicated via the KMADDRESS field of a MIGRATE
869 * message sent via the NETLINK or PF _KEY kernel socket interface.
870 *
871 * @param local local kmaddress
872 * @param remote remote kmaddress
873 */
874 void (*set_kmaddress) (ike_sa_t *this, host_t *local, host_t *remote);
875
876 /**
877 * Inherit all attributes of other to this after rekeying.
878 *
879 * When rekeying is completed, all CHILD_SAs, the virtual IP and all
880 * outstanding tasks are moved from other to this.
881 * As this call may initiate inherited tasks, a status is returned.
882 *
883 * @param other other task to inherit from
884 * @return DESTROY_ME if initiation of inherited task failed
885 */
886 status_t (*inherit) (ike_sa_t *this, ike_sa_t *other);
887
888 /**
889 * Reset the IKE_SA, useable when initiating fails
890 */
891 void (*reset) (ike_sa_t *this);
892
893 /**
894 * Destroys a ike_sa_t object.
895 */
896 void (*destroy) (ike_sa_t *this);
897 };
898
899 /**
900 * Creates an ike_sa_t object with a specific ID.
901 *
902 * @param ike_sa_id ike_sa_id_t object to associate with new IKE_SA
903 * @return ike_sa_t object
904 */
905 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id);
906
907 #endif /* IKE_SA_H_ @} */