src/libcharon/sa/ike_sa.h

   1 /*
   2  * Copyright (C) 2006-2011 Tobias Brunner
   3  * Copyright (C) 2006 Daniel Roethlisberger
   4  * Copyright (C) 2005-2009 Martin Willi
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 /**
  20  * @defgroup ike_sa ike_sa
  21  * @{ @ingroup sa
  22  */
  23
  24 #ifndef IKE_SA_H_
  25 #define IKE_SA_H_
  26
  27 typedef enum ike_extension_t ike_extension_t;
  28 typedef enum ike_condition_t ike_condition_t;
  29 typedef enum ike_sa_state_t ike_sa_state_t;
  30 typedef enum statistic_t statistic_t;
  31 typedef struct ike_sa_t ike_sa_t;
  32
  33 #include <library.h>
  34 #include <attributes/attribute_handler.h>
  35 #include <encoding/message.h>
  36 #include <encoding/payloads/proposal_substructure.h>
  37 #include <encoding/payloads/configuration_attribute.h>
  38 #include <sa/ike_sa_id.h>
  39 #include <sa/child_sa.h>
  40 #include <sa/task_manager.h>
  41 #include <sa/keymat.h>
  42 #include <config/peer_cfg.h>
  43 #include <config/ike_cfg.h>
  44 #include <credentials/auth_cfg.h>
  45
  46 /**
  47  * Timeout in seconds after that a half open IKE_SA gets deleted.
  48  */
  49 #define HALF_OPEN_IKE_SA_TIMEOUT 30
  50
  51 /**
  52  * Interval to send keepalives when NATed, in seconds.
  53  */
  54 #define KEEPALIVE_INTERVAL 20
  55
  56 /**
  57  * After which time rekeying should be retried if it failed, in seconds.
  58  */
  59 #define RETRY_INTERVAL 30
  60
  61 /**
  62  * Jitter to subtract from RETRY_INTERVAL to randomize rekey retry.
  63  */
  64 #define RETRY_JITTER 20
  65
  66 /**
  67  * Extensions (or optional features) the peer supports
  68  */
  69 enum ike_extension_t {
  70
  71         /**
  72          * peer supports NAT traversal as specified in RFC4306
  73          */
  74         EXT_NATT = (1<<0),
  75
  76         /**
  77          * peer supports MOBIKE (RFC4555)
  78          */
  79         EXT_MOBIKE = (1<<1),
  80
  81         /**
  82          * peer supports HTTP cert lookups as specified in RFC4306
  83          */
  84         EXT_HASH_AND_URL = (1<<2),
  85
  86         /**
  87          * peer supports multiple authentication exchanges, RFC4739
  88          */
  89         EXT_MULTIPLE_AUTH = (1<<3),
  90
  91         /**
  92          * peer uses strongSwan, accept private use extensions
  93          */
  94         EXT_STRONGSWAN = (1<<4),
  95
  96         /**
  97          * peer supports EAP-only authentication, draft-eronen-ipsec-ikev2-eap-auth
  98          */
  99         EXT_EAP_ONLY_AUTHENTICATION = (1<<5),
 100
 101         /**
 102          * peer is probably a Windows 7 RAS client
 103          */
 104         EXT_MS_WINDOWS = (1<<6),
 105
 106         /**
 107          * peer supports XAuth authentication, draft-ietf-ipsec-isakmp-xauth-06
 108          */
 109         EXT_XAUTH = (1<<7),
 110 };
 111
 112 /**
 113  * Conditions of an IKE_SA, change during its lifetime
 114  */
 115 enum ike_condition_t {
 116
 117         /**
 118          * Connection is natted (or faked) somewhere
 119          */
 120         COND_NAT_ANY = (1<<0),
 121
 122         /**
 123          * we are behind NAT
 124          */
 125         COND_NAT_HERE = (1<<1),
 126
 127         /**
 128          * other is behind NAT
 129          */
 130         COND_NAT_THERE = (1<<2),
 131
 132         /**
 133          * Faking NAT to enforce UDP encapsulation
 134          */
 135         COND_NAT_FAKE = (1<<3),
 136
 137         /**
 138          * peer has been authenticated using EAP at least once
 139          */
 140         COND_EAP_AUTHENTICATED = (1<<4),
 141
 142         /**
 143          * received a certificate request from the peer
 144          */
 145         COND_CERTREQ_SEEN = (1<<5),
 146
 147         /**
 148          * Local peer is the "original" IKE initiator. Unaffected from rekeying.
 149          */
 150         COND_ORIGINAL_INITIATOR = (1<<6),
 151
 152         /**
 153          * IKE_SA is stale, the peer is currently unreachable (MOBIKE)
 154          */
 155         COND_STALE = (1<<7),
 156 };
 157
 158 /**
 159  * Timing information and statistics to query from an SA
 160  */
 161 enum statistic_t {
 162         /** Timestamp of SA establishement */
 163         STAT_ESTABLISHED = 0,
 164         /** Timestamp of scheudled rekeying */
 165         STAT_REKEY,
 166         /** Timestamp of scheudled reauthentication */
 167         STAT_REAUTH,
 168         /** Timestamp of scheudled delete */
 169         STAT_DELETE,
 170         /** Timestamp of last inbound IKE packet */
 171         STAT_INBOUND,
 172         /** Timestamp of last outbound IKE packet */
 173         STAT_OUTBOUND,
 174
 175         STAT_MAX
 176 };
 177
 178 /**
 179  * State of an IKE_SA.
 180  *
 181  * An IKE_SA passes various states in its lifetime. A newly created
 182  * SA is in the state CREATED.
 183  * @verbatim
 184                  +----------------+
 185                  ¦   SA_CREATED   ¦
 186                  +----------------+
 187                          ¦
 188     on initiate()--->    ¦   <----- on IKE_SA_INIT received
 189                          V
 190                  +----------------+
 191                  ¦ SA_CONNECTING  ¦
 192                  +----------------+
 193                          ¦
 194                          ¦   <----- on IKE_AUTH successfully completed
 195                          V
 196                  +----------------+
 197                  ¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
 198                  +----------------+                         ¦
 199                          ¦                                  V
 200     on delete()--->      ¦   <----- on IKE_SA        +-------------+
 201                          ¦          delete request   ¦ SA_REKEYING ¦
 202                          ¦          received         +-------------+
 203                          V                                  ¦
 204                  +----------------+                         ¦
 205                  ¦  SA_DELETING   ¦<------------------------+ <-- after rekeying
 206                  +----------------+
 207                          ¦
 208                          ¦   <----- after delete() acknowledged
 209                          ¦
 210                         \V/
 211                          X
 212                         / \
 213    @endverbatim
 214  */
 215 enum ike_sa_state_t {
 216
 217         /**
 218          * IKE_SA just got created, but is not initiating nor responding yet.
 219          */
 220         IKE_CREATED,
 221
 222         /**
 223          * IKE_SA gets initiated actively or passively
 224          */
 225         IKE_CONNECTING,
 226
 227         /**
 228          * IKE_SA is fully established
 229          */
 230         IKE_ESTABLISHED,
 231
 232         /**
 233          * IKE_SA is managed externally and does not process messages
 234          */
 235         IKE_PASSIVE,
 236
 237         /**
 238          * IKE_SA rekeying in progress
 239          */
 240         IKE_REKEYING,
 241
 242         /**
 243          * IKE_SA is in progress of deletion
 244          */
 245         IKE_DELETING,
 246
 247         /**
 248          * IKE_SA object gets destroyed
 249          */
 250         IKE_DESTROYING,
 251 };
 252
 253 /**
 254  * enum names for ike_sa_state_t.
 255  */
 256 extern enum_name_t *ike_sa_state_names;
 257
 258 /**
 259  * Class ike_sa_t representing an IKE_SA.
 260  *
 261  * An IKE_SA contains crypto information related to a connection
 262  * with a peer. It contains multiple IPsec CHILD_SA, for which
 263  * it is responsible. All traffic is handled by an IKE_SA, using
 264  * the task manager and its tasks.
 265  */
 266 struct ike_sa_t {
 267
 268         /**
 269          * Get the id of the SA.
 270          *
 271          * Returned ike_sa_id_t object is not getting cloned!
 272          *
 273          * @return                              ike_sa's ike_sa_id_t
 274          */
 275         ike_sa_id_t* (*get_id) (ike_sa_t *this);
 276
 277         /**
 278          * Gets the IKE version of the SA
 279          */
 280         ike_version_t (*get_version)(ike_sa_t *this);
 281
 282         /**
 283          * Get the numerical ID uniquely defining this IKE_SA.
 284          *
 285          * @return                              unique ID
 286          */
 287         u_int32_t (*get_unique_id) (ike_sa_t *this);
 288
 289         /**
 290          * Get the state of the IKE_SA.
 291          *
 292          * @return                              state of the IKE_SA
 293          */
 294         ike_sa_state_t (*get_state) (ike_sa_t *this);
 295
 296         /**
 297          * Set the state of the IKE_SA.
 298          *
 299          * @param state                 state to set for the IKE_SA
 300          */
 301         void (*set_state) (ike_sa_t *this, ike_sa_state_t state);
 302
 303         /**
 304          * Get the name of the connection this IKE_SA uses.
 305          *
 306          * @return                              name
 307          */
 308         char* (*get_name) (ike_sa_t *this);
 309
 310         /**
 311          * Get statistic values from the IKE_SA.
 312          *
 313          * @param kind                  kind of requested value
 314          * @return                              value as integer
 315          */
 316         u_int32_t (*get_statistic)(ike_sa_t *this, statistic_t kind);
 317
 318         /**
 319          * Get the own host address.
 320          *
 321          * @return                              host address
 322          */
 323         host_t* (*get_my_host) (ike_sa_t *this);
 324
 325         /**
 326          * Set the own host address.
 327          *
 328          * @param me                    host address
 329          */
 330         void (*set_my_host) (ike_sa_t *this, host_t *me);
 331
 332         /**
 333          * Get the other peers host address.
 334          *
 335          * @return                              host address
 336          */
 337         host_t* (*get_other_host) (ike_sa_t *this);
 338
 339         /**
 340          * Set the others host address.
 341          *
 342          * @param other                 host address
 343          */
 344         void (*set_other_host) (ike_sa_t *this, host_t *other);
 345
 346         /**
 347          * Float to port 4500 (e.g. if a NAT is detected).
 348          *
 349          * The port of either endpoint is changed only if it is currently
 350          * set to the default value of 500.
 351          */
 352         void (*float_ports)(ike_sa_t *this);
 353
 354         /**
 355          * Update the IKE_SAs host.
 356          *
 357          * Hosts may be NULL to use current host.
 358          *
 359          * @param me                    new local host address, or NULL
 360          * @param other                 new remote host address, or NULL
 361          * @param force                 force update
 362          */
 363         void (*update_hosts)(ike_sa_t *this, host_t *me, host_t *other, bool force);
 364
 365         /**
 366          * Get the own identification.
 367          *
 368          * @return                              identification
 369          */
 370         identification_t* (*get_my_id) (ike_sa_t *this);
 371
 372         /**
 373          * Set the own identification.
 374          *
 375          * @param me                    identification
 376          */
 377         void (*set_my_id) (ike_sa_t *this, identification_t *me);
 378
 379         /**
 380          * Get the other peer's identification.
 381          *
 382          * @return                              identification
 383          */
 384         identification_t* (*get_other_id) (ike_sa_t *this);
 385
 386         /**
 387          * Get the others peer identity, but prefer an EAP-Identity.
 388          *
 389          * @return                              EAP or IKEv2 identity
 390          */
 391         identification_t* (*get_other_eap_id)(ike_sa_t *this);
 392
 393         /**
 394          * Set the other peer's identification.
 395          *
 396          * @param other                 identification
 397          */
 398         void (*set_other_id) (ike_sa_t *this, identification_t *other);
 399
 400         /**
 401          * Get the config used to setup this IKE_SA.
 402          *
 403          * @return                              ike_config
 404          */
 405         ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
 406
 407         /**
 408          * Set the config to setup this IKE_SA.
 409          *
 410          * @param config                ike_config to use
 411          */
 412         void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
 413
 414         /**
 415          * Get the peer config used by this IKE_SA.
 416          *
 417          * @return                              peer_config
 418          */
 419         peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
 420
 421         /**
 422          * Set the peer config to use with this IKE_SA.
 423          *
 424          * @param config                peer_config to use
 425          */
 426         void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
 427
 428         /**
 429          * Get the authentication config with rules of the current auth round.
 430          *
 431          * @param local                 TRUE for local rules, FALSE for remote constraints
 432          * @return                              current cfg
 433          */
 434         auth_cfg_t* (*get_auth_cfg)(ike_sa_t *this, bool local);
 435
 436         /**
 437          * Insert a completed authentication round.
 438          *
 439          * @param local                 TRUE for own rules, FALSE for others constraints
 440          * @param cfg                   auth config to append
 441          */
 442         void (*add_auth_cfg)(ike_sa_t *this, bool local, auth_cfg_t *cfg);
 443
 444         /**
 445          * Create an enumerator over added authentication rounds.
 446          *
 447          * @param local                 TRUE for own rules, FALSE for others constraints
 448          * @return                              enumerator over auth_cfg_t
 449          */
 450         enumerator_t* (*create_auth_cfg_enumerator)(ike_sa_t *this, bool local);
 451
 452         /**
 453          * Get the selected proposal of this IKE_SA.
 454          *
 455          * @return                              selected proposal
 456          */
 457         proposal_t* (*get_proposal)(ike_sa_t *this);
 458
 459         /**
 460          * Set the proposal selected for this IKE_SA.
 461          *
 462          * @param                               selected proposal
 463          */
 464         void (*set_proposal)(ike_sa_t *this, proposal_t *proposal);
 465
 466         /**
 467          * Set the message id of the IKE_SA.
 468          *
 469          * The IKE_SA stores two message IDs, one for initiating exchanges (send)
 470          * and one to respond to exchanges (expect).
 471          *
 472          * @param initiate              TRUE to set message ID for initiating
 473          * @param mid                   message id to set
 474          */
 475         void (*set_message_id)(ike_sa_t *this, bool initiate, u_int32_t mid);
 476
 477         /**
 478          * Add an additional address for the peer.
 479          *
 480          * In MOBIKE, a peer may transmit additional addresses where it is
 481          * reachable. These are stored in the IKE_SA.
 482          * The own list of addresses is not stored, they are queried from
 483          * the kernel when required.
 484          *
 485          * @param host                  host to add to list
 486          */
 487         void (*add_additional_address)(ike_sa_t *this, host_t *host);
 488
 489         /**
 490          * Create an enumerator over all additional addresses of the peer.
 491          *
 492          * @return                              enumerator over addresses
 493          */
 494         enumerator_t* (*create_additional_address_enumerator)(ike_sa_t *this);
 495
 496         /**
 497          * Remove all additional addresses of the peer.
 498          */
 499         void (*remove_additional_addresses)(ike_sa_t *this);
 500
 501         /**
 502          * Check if mappings have changed on a NAT for our source address.
 503          *
 504          * @param hash                  received DESTINATION_IP hash
 505          * @return                              TRUE if mappings have changed
 506          */
 507         bool (*has_mapping_changed)(ike_sa_t *this, chunk_t hash);
 508
 509         /**
 510          * Enable an extension the peer supports.
 511          *
 512          * If support for an IKE extension is detected, this method is called
 513          * to enable that extension and behave accordingly.
 514          *
 515          * @param extension             extension to enable
 516          */
 517         void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
 518
 519         /**
 520          * Check if the peer supports an extension.
 521          *
 522          * @param extension             extension to check for support
 523          * @return                              TRUE if peer supports it, FALSE otherwise
 524          */
 525         bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
 526
 527         /**
 528          * Enable/disable a condition flag for this IKE_SA.
 529          *
 530          * @param condition             condition to enable/disable
 531          * @param enable                TRUE to enable condition, FALSE to disable
 532          */
 533         void (*set_condition) (ike_sa_t *this, ike_condition_t condition, bool enable);
 534
 535         /**
 536          * Check if a condition flag is set.
 537          *
 538          * @param condition             condition to check
 539          * @return                              TRUE if condition flag set, FALSE otherwise
 540          */
 541         bool (*has_condition) (ike_sa_t *this, ike_condition_t condition);
 542
 543         /**
 544          * Get the number of queued MOBIKE address updates.
 545          *
 546          * @return                              number of pending updates
 547          */
 548         u_int32_t (*get_pending_updates)(ike_sa_t *this);
 549
 550         /**
 551          * Set the number of queued MOBIKE address updates.
 552          *
 553          * @param updates               number of pending updates
 554          */
 555         void (*set_pending_updates)(ike_sa_t *this, u_int32_t updates);
 556
 557 #ifdef ME
 558         /**
 559          * Activate mediation server functionality for this IKE_SA.
 560          */
 561         void (*act_as_mediation_server) (ike_sa_t *this);
 562
 563         /**
 564          * Get the server reflexive host.
 565          *
 566          * @return                              server reflexive host
 567          */
 568         host_t* (*get_server_reflexive_host) (ike_sa_t *this);
 569
 570         /**
 571          * Set the server reflexive host.
 572          *
 573          * @param host                  server reflexive host
 574          */
 575         void (*set_server_reflexive_host) (ike_sa_t *this, host_t *host);
 576
 577         /**
 578          * Get the connect ID.
 579          *
 580          * @return                              connect ID
 581          */
 582         chunk_t (*get_connect_id) (ike_sa_t *this);
 583
 584         /**
 585          * Initiate the mediation of a mediated connection (i.e. initiate a
 586          * ME_CONNECT exchange to a mediation server).
 587          *
 588          * @param mediated_cfg  peer_cfg of the mediated connection
 589          * @return
 590          *                                              - SUCCESS if initialization started
 591          *                                              - DESTROY_ME if initialization failed
 592          */
 593         status_t (*initiate_mediation) (ike_sa_t *this, peer_cfg_t *mediated_cfg);
 594
 595         /**
 596          * Initiate the mediated connection
 597          *
 598          * @param me                    local endpoint (gets cloned)
 599          * @param other                 remote endpoint (gets cloned)
 600          * @param connect_id    connect ID (gets cloned)
 601          * @return
 602          *                                              - SUCCESS if initialization started
 603          *                                              - DESTROY_ME if initialization failed
 604          */
 605         status_t (*initiate_mediated) (ike_sa_t *this, host_t *me, host_t *other,
 606                                                                    chunk_t connect_id);
 607
 608         /**
 609          * Relay data from one peer to another (i.e. initiate a ME_CONNECT exchange
 610          * to a peer).
 611          *
 612          * Data is cloned.
 613          *
 614          * @param requester             ID of the requesting peer
 615          * @param connect_id    data of the ME_CONNECTID payload
 616          * @param connect_key   data of the ME_CONNECTKEY payload
 617          * @param endpoints             endpoints
 618          * @param response              TRUE if this is a response
 619          * @return
 620          *                                              - SUCCESS if relay started
 621          *                                              - DESTROY_ME if relay failed
 622          */
 623         status_t (*relay) (ike_sa_t *this, identification_t *requester,
 624                                            chunk_t connect_id, chunk_t connect_key,
 625                                            linked_list_t *endpoints, bool response);
 626
 627         /**
 628          * Send a callback to a peer.
 629          *
 630          * Data is cloned.
 631          *
 632          * @param peer_id               ID of the other peer
 633          * @return
 634          *                                              - SUCCESS if response started
 635          *                                              - DESTROY_ME if response failed
 636          */
 637         status_t (*callback) (ike_sa_t *this, identification_t *peer_id);
 638
 639         /**
 640          * Respond to a ME_CONNECT request.
 641          *
 642          * Data is cloned.
 643          *
 644          * @param peer_id               ID of the other peer
 645          * @param connect_id    the connect ID supplied by the initiator
 646          * @return
 647          *                                              - SUCCESS if response started
 648          *                                              - DESTROY_ME if response failed
 649          */
 650         status_t (*respond) (ike_sa_t *this, identification_t *peer_id,
 651                                                  chunk_t connect_id);
 652 #endif /* ME */
 653
 654         /**
 655          * Initiate a new connection.
 656          *
 657          * The configs are owned by the IKE_SA after the call. If the initiate
 658          * is triggered by a packet, traffic selectors of the packet can be added
 659          * to the CHILD_SA.
 660          *
 661          * @param child_cfg             child config to create CHILD from
 662          * @param reqid                 reqid to use for CHILD_SA, 0 assigne uniquely
 663          * @param tsi                   source of triggering packet
 664          * @param tsr                   destination of triggering packet.
 665          * @return
 666          *                                              - SUCCESS if initialization started
 667          *                                              - DESTROY_ME if initialization failed
 668          */
 669         status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg,
 670                                                   u_int32_t reqid, traffic_selector_t *tsi,
 671                                                   traffic_selector_t *tsr);
 672
 673         /**
 674          * Initiates the deletion of an IKE_SA.
 675          *
 676          * Sends a delete message to the remote peer and waits for
 677          * its response. If the response comes in, or a timeout occurs,
 678          * the IKE SA gets deleted.
 679          *
 680          * @return
 681          *                                              - SUCCESS if deletion is initialized
 682          *                                              - DESTROY_ME, if the IKE_SA is not in
 683          *                                                an established state and can not be
 684          *                                                deleted (but destroyed).
 685          */
 686         status_t (*delete) (ike_sa_t *this);
 687
 688         /**
 689          * Update IKE_SAs after network interfaces have changed.
 690          *
 691          * Whenever the network interface configuration changes, the kernel
 692          * interface calls roam() on each IKE_SA. The IKE_SA then checks if
 693          * the new network config requires changes, and handles appropriate.
 694          * If MOBIKE is supported, addresses are updated; If not, the tunnel is
 695          * restarted.
 696          *
 697          * @param address               TRUE if address list changed, FALSE otherwise
 698          * @return                              SUCCESS, FAILED, DESTROY_ME
 699          */
 700         status_t (*roam)(ike_sa_t *this, bool address);
 701
 702         /**
 703          * Processes a incoming IKEv2-Message.
 704          *
 705          * Message processing may fail. If a critical failure occurs,
 706          * process_message() return DESTROY_ME. Then the caller must
 707          * destroy the IKE_SA immediately, as it is unusable.
 708          *
 709          * @param message               message to process
 710          * @return
 711          *                                              - SUCCESS
 712          *                                              - FAILED
 713          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 714          */
 715         status_t (*process_message) (ike_sa_t *this, message_t *message);
 716
 717         /**
 718          * Generate a IKE message to send it to the peer.
 719          *
 720          * This method generates all payloads in the message and encrypts/signs
 721          * the packet.
 722          *
 723          * @param message               message to generate
 724          * @param packet                generated output packet
 725          * @return
 726          *                                              - SUCCESS
 727          *                                              - FAILED
 728          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 729          */
 730         status_t (*generate_message) (ike_sa_t *this, message_t *message,
 731                                                                   packet_t **packet);
 732
 733         /**
 734          * Retransmits a request.
 735          *
 736          * @param message_id    ID of the request to retransmit
 737          * @return
 738          *                                              - SUCCESS
 739          *                                              - NOT_FOUND if request doesn't have to be retransmited
 740          */
 741         status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
 742
 743         /**
 744          * Sends a DPD request to the peer.
 745          *
 746          * To check if a peer is still alive, periodic
 747          * empty INFORMATIONAL messages are sent if no
 748          * other traffic was received.
 749          *
 750          * @return
 751          *                                              - SUCCESS
 752          *                                              - DESTROY_ME, if peer did not respond
 753          */
 754         status_t (*send_dpd) (ike_sa_t *this);
 755
 756         /**
 757          * Sends a keep alive packet.
 758          *
 759          * To refresh NAT tables in a NAT router
 760          * between the peers, periodic empty
 761          * UDP packets are sent if no other traffic
 762          * was sent.
 763          */
 764         void (*send_keepalive) (ike_sa_t *this);
 765
 766         /**
 767          * Get the keying material of this IKE_SA.
 768          *
 769          * @return                              per IKE_SA keymat instance
 770          */
 771         keymat_t* (*get_keymat)(ike_sa_t *this);
 772
 773         /**
 774          * Associates a child SA to this IKE SA
 775          *
 776          * @param child_sa              child_sa to add
 777          */
 778         void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
 779
 780         /**
 781          * Get a CHILD_SA identified by protocol and SPI.
 782          *
 783          * @param protocol              protocol of the SA
 784          * @param spi                   SPI of the CHILD_SA
 785          * @param inbound               TRUE if SPI is inbound, FALSE if outbound
 786          * @return                              child_sa, or NULL if none found
 787          */
 788         child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
 789                                                                  u_int32_t spi, bool inbound);
 790
 791         /**
 792          * Get the number of CHILD_SAs.
 793          *
 794          * @return                              number of CHILD_SAs
 795          */
 796         int (*get_child_count) (ike_sa_t *this);
 797
 798         /**
 799          * Create an enumerator over all CHILD_SAs.
 800          *
 801          * @return                              enumerator
 802          */
 803         enumerator_t* (*create_child_sa_enumerator) (ike_sa_t *this);
 804
 805         /**
 806          * Remove the CHILD_SA the given enumerator points to from this IKE_SA.
 807          *
 808          * @param enumerator    enumerator pointing to CHILD_SA
 809          */
 810         void (*remove_child_sa) (ike_sa_t *this, enumerator_t *enumerator);
 811
 812         /**
 813          * Rekey the CHILD SA with the specified reqid.
 814          *
 815          * Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
 816          *
 817          * @param protocol              protocol of the SA
 818          * @param spi                   inbound SPI of the CHILD_SA
 819          * @return
 820          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 821          *                                              - SUCCESS, if rekeying initiated
 822          */
 823         status_t (*rekey_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 824
 825         /**
 826          * Close the CHILD SA with the specified protocol/SPI.
 827          *
 828          * Looks for a CHILD SA owned by this IKE_SA, deletes it and
 829          * notify's the remote peer about the delete. The associated
 830          * states and policies in the kernel get deleted, if they exist.
 831          *
 832          * @param protocol              protocol of the SA
 833          * @param spi                   inbound SPI of the CHILD_SA
 834          * @return
 835          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 836          *                                              - SUCCESS, if delete message sent
 837          */
 838         status_t (*delete_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 839
 840         /**
 841          * Destroy a CHILD SA with the specified protocol/SPI.
 842          *
 843          * Looks for a CHILD SA owned by this IKE_SA and destroys it.
 844          *
 845          * @param protocol              protocol of the SA
 846          * @param spi                   inbound SPI of the CHILD_SA
 847          * @return
 848          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 849          *                                              - SUCCESS
 850          */
 851         status_t (*destroy_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 852
 853         /**
 854          * Rekey the IKE_SA.
 855          *
 856          * Sets up a new IKE_SA, moves all CHILDs to it and deletes this IKE_SA.
 857          *
 858          * @return                              - SUCCESS, if IKE_SA rekeying initiated
 859          */
 860         status_t (*rekey) (ike_sa_t *this);
 861
 862         /**
 863          * Reauthenticate the IKE_SA.
 864          *
 865          * Create a completely new IKE_SA with authentication, recreates all children
 866          * within the IKE_SA, closes this IKE_SA.
 867          *
 868          * @return                              DESTROY_ME to destroy the IKE_SA
 869          */
 870         status_t (*reauth) (ike_sa_t *this);
 871
 872         /**
 873          * Restablish the IKE_SA.
 874          *
 875          * Reestablish an IKE_SA after it has been closed.
 876          *
 877          * @return                              DESTROY_ME to destroy the IKE_SA
 878          */
 879         status_t (*reestablish) (ike_sa_t *this);
 880
 881         /**
 882          * Set the lifetime limit received from a AUTH_LIFETIME notify.
 883          *
 884          * @param lifetime              lifetime in seconds
 885          */
 886         void (*set_auth_lifetime)(ike_sa_t *this, u_int32_t lifetime);
 887
 888         /**
 889          * Set the virtual IP to use for this IKE_SA and its children.
 890          *
 891          * The virtual IP is assigned per IKE_SA, not per CHILD_SA. It has the same
 892          * lifetime as the IKE_SA.
 893          *
 894          * @param local                 TRUE to set local address, FALSE for remote
 895          * @param ip                    IP to set as virtual IP
 896          */
 897         void (*set_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
 898
 899         /**
 900          * Get the virtual IP configured.
 901          *
 902          * @param local                 TRUE to get local virtual IP, FALSE for remote
 903          * @return                              host_t *virtual IP
 904          */
 905         host_t* (*get_virtual_ip) (ike_sa_t *this, bool local);
 906
 907         /**
 908          * Register a configuration attribute to the IKE_SA.
 909          *
 910          * If an IRAS sends a configuration attribute it is installed and
 911          * registered at the IKE_SA. Attributes are inherit()ed and get released
 912          * when the IKE_SA is closed.
 913          *
 914          * @param handler               handler installed the attribute, use for release()
 915          * @param type                  configuration attribute type
 916          * @param data                  associated attribute data
 917          */
 918         void (*add_configuration_attribute)(ike_sa_t *this,
 919                                                         attribute_handler_t *handler,
 920                                                         configuration_attribute_type_t type, chunk_t data);
 921
 922         /**
 923          * Set local and remote host addresses to be used for IKE.
 924          *
 925          * These addresses are communicated via the KMADDRESS field of a MIGRATE
 926          * message sent via the NETLINK or PF _KEY kernel socket interface.
 927          *
 928          * @param local                 local kmaddress
 929          * @param remote                remote kmaddress
 930          */
 931         void (*set_kmaddress) (ike_sa_t *this, host_t *local, host_t *remote);
 932
 933         /**
 934          * Create enumerator over a task queue of this IKE_SA.
 935          *
 936          * @param                               queue type to enumerate
 937          * @return                              enumerator over task_t
 938          */
 939         enumerator_t* (*create_task_enumerator)(ike_sa_t *this, task_queue_t queue);
 940
 941         /**
 942          * Inherit all attributes of other to this after rekeying.
 943          *
 944          * When rekeying is completed, all CHILD_SAs, the virtual IP and all
 945          * outstanding tasks are moved from other to this.
 946          * As this call may initiate inherited tasks, a status is returned.
 947          *
 948          * @param other                 other task to inherit from
 949          */
 950         void (*inherit) (ike_sa_t *this, ike_sa_t *other);
 951
 952         /**
 953          * Reset the IKE_SA, useable when initiating fails
 954          */
 955         void (*reset) (ike_sa_t *this);
 956
 957         /**
 958          * Destroys a ike_sa_t object.
 959          */
 960         void (*destroy) (ike_sa_t *this);
 961
 962         /**
 963          * Initiate an XAuth transaction
 964          */
 965         void (*initiate_xauth) (ike_sa_t *this);
 966 };
 967
 968 /**
 969  * Creates an ike_sa_t object with a specific ID and IKE version.
 970  *
 971  * @param ike_sa_id             ike_sa_id_t to associate with new IKE_SA/ISAKMP_SA
 972  * @param initiator             TRUE to create this IKE_SA as initiator
 973  * @param version               IKE version of this SA
 974  * @return                              ike_sa_t object
 975  */
 976 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator,
 977                                                 ike_version_t version);
 978
 979 #endif /** IKE_SA_H_ @}*/