src/libcharon/network/receiver.h

   1 /*
   2  * Copyright (C) 2005-2007 Martin Willi
   3  * Copyright (C) 2005 Jan Hutter
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 /**
  18  * @defgroup receiver receiver
  19  * @{ @ingroup network
  20  */
  21
  22 #ifndef RECEIVER_H_
  23 #define RECEIVER_H_
  24
  25 typedef struct receiver_t receiver_t;
  26
  27 #include <library.h>
  28 #include <utils/host.h>
  29
  30 /**
  31  * Receives packets from the socket and adds them to the job queue.
  32  *
  33  * The receiver starts a thread, wich reads on the blocking socket. A received
  34  * packet is preparsed and a process_message_job is queued in the job queue.
  35  *
  36  * To endure DoS attacks, cookies are enabled when to many IKE_SAs are half
  37  * open. The calculation of cookies is slightly different from the proposed
  38  * method in RFC4306. We do not include a nonce, because we think the advantage
  39  * we gain does not justify the overhead to parse the whole message.
  40  * Instead of VersionIdOfSecret, we include a timestamp. This allows us to
  41  * find out wich key was used for cookie creation. Further, we can set a
  42  * lifetime for the cookie, which allows us to reuse the secret for a longer
  43  * time.
  44  *               COOKIE = time | sha1( IPi | SPIi | time | secret )
  45  *
  46  * The secret is changed after a certain amount of cookies sent. The old
  47  * secret is stored to allow a clean migration between secret changes.
  48  *
  49  * Further, the number of half-initiated IKE_SAs is limited per peer. This
  50  * mades it impossible for a peer to flood the server with its real IP address.
  51  */
  52 struct receiver_t {
  53
  54         /**
  55          * Destroys a receiver_t object.
  56          */
  57         void (*destroy) (receiver_t *receiver);
  58 };
  59
  60 /**
  61  * Create a receiver_t object.
  62  *
  63  * The receiver thread will start working, get data
  64  * from the socket and add those packets to the job queue.
  65  *
  66  * @return      receiver_t object, NULL if initialization fails
  67  */
  68 receiver_t * receiver_create(void);
  69
  70 #endif /** RECEIVER_H_ @}*/