src/libcharon/sa/ike_sa.h

   1 /*
   2  * Copyright (C) 2006-2011 Tobias Brunner
   3  * Copyright (C) 2006 Daniel Roethlisberger
   4  * Copyright (C) 2005-2009 Martin Willi
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 /**
  20  * @defgroup ike_sa ike_sa
  21  * @{ @ingroup sa
  22  */
  23
  24 #ifndef IKE_SA_H_
  25 #define IKE_SA_H_
  26
  27 typedef enum ike_extension_t ike_extension_t;
  28 typedef enum ike_condition_t ike_condition_t;
  29 typedef enum ike_sa_state_t ike_sa_state_t;
  30 typedef enum statistic_t statistic_t;
  31 typedef struct ike_sa_t ike_sa_t;
  32
  33 #include <library.h>
  34 #include <attributes/attribute_handler.h>
  35 #include <encoding/message.h>
  36 #include <encoding/payloads/proposal_substructure.h>
  37 #include <encoding/payloads/configuration_attribute.h>
  38 #include <sa/ike_sa_id.h>
  39 #include <sa/child_sa.h>
  40 #include <sa/task_manager.h>
  41 #include <sa/keymat.h>
  42 #include <config/peer_cfg.h>
  43 #include <config/ike_cfg.h>
  44 #include <credentials/auth_cfg.h>
  45
  46 /**
  47  * Timeout in seconds after that a half open IKE_SA gets deleted.
  48  */
  49 #define HALF_OPEN_IKE_SA_TIMEOUT 30
  50
  51 /**
  52  * Interval to send keepalives when NATed, in seconds.
  53  */
  54 #define KEEPALIVE_INTERVAL 20
  55
  56 /**
  57  * After which time rekeying should be retried if it failed, in seconds.
  58  */
  59 #define RETRY_INTERVAL 30
  60
  61 /**
  62  * Jitter to subtract from RETRY_INTERVAL to randomize rekey retry.
  63  */
  64 #define RETRY_JITTER 20
  65
  66 /**
  67  * Extensions (or optional features) the peer supports
  68  */
  69 enum ike_extension_t {
  70
  71         /**
  72          * peer supports NAT traversal as specified in RFC4306
  73          */
  74         EXT_NATT = (1<<0),
  75
  76         /**
  77          * peer supports MOBIKE (RFC4555)
  78          */
  79         EXT_MOBIKE = (1<<1),
  80
  81         /**
  82          * peer supports HTTP cert lookups as specified in RFC4306
  83          */
  84         EXT_HASH_AND_URL = (1<<2),
  85
  86         /**
  87          * peer supports multiple authentication exchanges, RFC4739
  88          */
  89         EXT_MULTIPLE_AUTH = (1<<3),
  90
  91         /**
  92          * peer uses strongSwan, accept private use extensions
  93          */
  94         EXT_STRONGSWAN = (1<<4),
  95
  96         /**
  97          * peer supports EAP-only authentication, draft-eronen-ipsec-ikev2-eap-auth
  98          */
  99         EXT_EAP_ONLY_AUTHENTICATION = (1<<5),
 100
 101         /**
 102          * peer is probably a Windows 7 RAS client
 103          */
 104         EXT_MS_WINDOWS = (1<<6),
 105 };
 106
 107 /**
 108  * Conditions of an IKE_SA, change during its lifetime
 109  */
 110 enum ike_condition_t {
 111
 112         /**
 113          * Connection is natted (or faked) somewhere
 114          */
 115         COND_NAT_ANY = (1<<0),
 116
 117         /**
 118          * we are behind NAT
 119          */
 120         COND_NAT_HERE = (1<<1),
 121
 122         /**
 123          * other is behind NAT
 124          */
 125         COND_NAT_THERE = (1<<2),
 126
 127         /**
 128          * Faking NAT to enforce UDP encapsulation
 129          */
 130         COND_NAT_FAKE = (1<<3),
 131
 132         /**
 133          * peer has been authenticated using EAP at least once
 134          */
 135         COND_EAP_AUTHENTICATED = (1<<4),
 136
 137         /**
 138          * received a certificate request from the peer
 139          */
 140         COND_CERTREQ_SEEN = (1<<5),
 141
 142         /**
 143          * Local peer is the "original" IKE initiator. Unaffected from rekeying.
 144          */
 145         COND_ORIGINAL_INITIATOR = (1<<6),
 146
 147         /**
 148          * IKE_SA is stale, the peer is currently unreachable (MOBIKE)
 149          */
 150         COND_STALE = (1<<7),
 151 };
 152
 153 /**
 154  * Timing information and statistics to query from an SA
 155  */
 156 enum statistic_t {
 157         /** Timestamp of SA establishement */
 158         STAT_ESTABLISHED = 0,
 159         /** Timestamp of scheudled rekeying */
 160         STAT_REKEY,
 161         /** Timestamp of scheudled reauthentication */
 162         STAT_REAUTH,
 163         /** Timestamp of scheudled delete */
 164         STAT_DELETE,
 165         /** Timestamp of last inbound IKE packet */
 166         STAT_INBOUND,
 167         /** Timestamp of last outbound IKE packet */
 168         STAT_OUTBOUND,
 169
 170         STAT_MAX
 171 };
 172
 173 /**
 174  * State of an IKE_SA.
 175  *
 176  * An IKE_SA passes various states in its lifetime. A newly created
 177  * SA is in the state CREATED.
 178  * @verbatim
 179                  +----------------+
 180                  ¦   SA_CREATED   ¦
 181                  +----------------+
 182                          ¦
 183     on initiate()--->    ¦   <----- on IKE_SA_INIT received
 184                          V
 185                  +----------------+
 186                  ¦ SA_CONNECTING  ¦
 187                  +----------------+
 188                          ¦
 189                          ¦   <----- on IKE_AUTH successfully completed
 190                          V
 191                  +----------------+
 192                  ¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
 193                  +----------------+                         ¦
 194                          ¦                                  V
 195     on delete()--->      ¦   <----- on IKE_SA        +-------------+
 196                          ¦          delete request   ¦ SA_REKEYING ¦
 197                          ¦          received         +-------------+
 198                          V                                  ¦
 199                  +----------------+                         ¦
 200                  ¦  SA_DELETING   ¦<------------------------+ <-- after rekeying
 201                  +----------------+
 202                          ¦
 203                          ¦   <----- after delete() acknowledged
 204                          ¦
 205                         \V/
 206                          X
 207                         / \
 208    @endverbatim
 209  */
 210 enum ike_sa_state_t {
 211
 212         /**
 213          * IKE_SA just got created, but is not initiating nor responding yet.
 214          */
 215         IKE_CREATED,
 216
 217         /**
 218          * IKE_SA gets initiated actively or passively
 219          */
 220         IKE_CONNECTING,
 221
 222         /**
 223          * IKE_SA is fully established
 224          */
 225         IKE_ESTABLISHED,
 226
 227         /**
 228          * IKE_SA is managed externally and does not process messages
 229          */
 230         IKE_PASSIVE,
 231
 232         /**
 233          * IKE_SA rekeying in progress
 234          */
 235         IKE_REKEYING,
 236
 237         /**
 238          * IKE_SA is in progress of deletion
 239          */
 240         IKE_DELETING,
 241
 242         /**
 243          * IKE_SA object gets destroyed
 244          */
 245         IKE_DESTROYING,
 246 };
 247
 248 /**
 249  * enum names for ike_sa_state_t.
 250  */
 251 extern enum_name_t *ike_sa_state_names;
 252
 253 /**
 254  * Class ike_sa_t representing an IKE_SA.
 255  *
 256  * An IKE_SA contains crypto information related to a connection
 257  * with a peer. It contains multiple IPsec CHILD_SA, for which
 258  * it is responsible. All traffic is handled by an IKE_SA, using
 259  * the task manager and its tasks.
 260  */
 261 struct ike_sa_t {
 262
 263         /**
 264          * Get the id of the SA.
 265          *
 266          * Returned ike_sa_id_t object is not getting cloned!
 267          *
 268          * @return                              ike_sa's ike_sa_id_t
 269          */
 270         ike_sa_id_t* (*get_id) (ike_sa_t *this);
 271
 272         /**
 273          * Get the numerical ID uniquely defining this IKE_SA.
 274          *
 275          * @return                              unique ID
 276          */
 277         u_int32_t (*get_unique_id) (ike_sa_t *this);
 278
 279         /**
 280          * Get the state of the IKE_SA.
 281          *
 282          * @return                              state of the IKE_SA
 283          */
 284         ike_sa_state_t (*get_state) (ike_sa_t *this);
 285
 286         /**
 287          * Set the state of the IKE_SA.
 288          *
 289          * @param state                 state to set for the IKE_SA
 290          */
 291         void (*set_state) (ike_sa_t *this, ike_sa_state_t ike_sa);
 292
 293         /**
 294          * Get the name of the connection this IKE_SA uses.
 295          *
 296          * @return                              name
 297          */
 298         char* (*get_name) (ike_sa_t *this);
 299
 300         /**
 301          * Get statistic values from the IKE_SA.
 302          *
 303          * @param kind                  kind of requested value
 304          * @return                              value as integer
 305          */
 306         u_int32_t (*get_statistic)(ike_sa_t *this, statistic_t kind);
 307
 308         /**
 309          * Get the own host address.
 310          *
 311          * @return                              host address
 312          */
 313         host_t* (*get_my_host) (ike_sa_t *this);
 314
 315         /**
 316          * Set the own host address.
 317          *
 318          * @param me                    host address
 319          */
 320         void (*set_my_host) (ike_sa_t *this, host_t *me);
 321
 322         /**
 323          * Get the other peers host address.
 324          *
 325          * @return                              host address
 326          */
 327         host_t* (*get_other_host) (ike_sa_t *this);
 328
 329         /**
 330          * Set the others host address.
 331          *
 332          * @param other                 host address
 333          */
 334         void (*set_other_host) (ike_sa_t *this, host_t *other);
 335
 336         /**
 337          * Float to port 4500 (e.g. if a NAT is detected).
 338          *
 339          * The port of either endpoint is changed only if it is currently
 340          * set to the default value of 500.
 341          */
 342         void (*float_ports)(ike_sa_t *this);
 343
 344         /**
 345          * Update the IKE_SAs host.
 346          *
 347          * Hosts may be NULL to use current host.
 348          *
 349          * @param me                    new local host address, or NULL
 350          * @param other                 new remote host address, or NULL
 351          * @param force                 force update
 352          */
 353         void (*update_hosts)(ike_sa_t *this, host_t *me, host_t *other, bool force);
 354
 355         /**
 356          * Get the own identification.
 357          *
 358          * @return                              identification
 359          */
 360         identification_t* (*get_my_id) (ike_sa_t *this);
 361
 362         /**
 363          * Set the own identification.
 364          *
 365          * @param me                    identification
 366          */
 367         void (*set_my_id) (ike_sa_t *this, identification_t *me);
 368
 369         /**
 370          * Get the other peer's identification.
 371          *
 372          * @return                              identification
 373          */
 374         identification_t* (*get_other_id) (ike_sa_t *this);
 375
 376         /**
 377          * Get the others peer identity, but prefer an EAP-Identity.
 378          *
 379          * @return                              EAP or IKEv2 identity
 380          */
 381         identification_t* (*get_other_eap_id)(ike_sa_t *this);
 382
 383         /**
 384          * Set the other peer's identification.
 385          *
 386          * @param other                 identification
 387          */
 388         void (*set_other_id) (ike_sa_t *this, identification_t *other);
 389
 390         /**
 391          * Get the config used to setup this IKE_SA.
 392          *
 393          * @return                              ike_config
 394          */
 395         ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
 396
 397         /**
 398          * Set the config to setup this IKE_SA.
 399          *
 400          * @param config                ike_config to use
 401          */
 402         void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
 403
 404         /**
 405          * Get the peer config used by this IKE_SA.
 406          *
 407          * @return                              peer_config
 408          */
 409         peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
 410
 411         /**
 412          * Set the peer config to use with this IKE_SA.
 413          *
 414          * @param config                peer_config to use
 415          */
 416         void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
 417
 418         /**
 419          * Get the authentication config with rules of the current auth round.
 420          *
 421          * @param local                 TRUE for local rules, FALSE for remote constraints
 422          * @return                              current cfg
 423          */
 424         auth_cfg_t* (*get_auth_cfg)(ike_sa_t *this, bool local);
 425
 426         /**
 427          * Insert a completed authentication round.
 428          *
 429          * @param local                 TRUE for own rules, FALSE for others constraints
 430          * @param cfg                   auth config to append
 431          */
 432         void (*add_auth_cfg)(ike_sa_t *this, bool local, auth_cfg_t *cfg);
 433
 434         /**
 435          * Create an enumerator over added authentication rounds.
 436          *
 437          * @param local                 TRUE for own rules, FALSE for others constraints
 438          * @return                              enumerator over auth_cfg_t
 439          */
 440         enumerator_t* (*create_auth_cfg_enumerator)(ike_sa_t *this, bool local);
 441
 442         /**
 443          * Get the selected proposal of this IKE_SA.
 444          *
 445          * @return                              selected proposal
 446          */
 447         proposal_t* (*get_proposal)(ike_sa_t *this);
 448
 449         /**
 450          * Set the proposal selected for this IKE_SA.
 451          *
 452          * @param                               selected proposal
 453          */
 454         void (*set_proposal)(ike_sa_t *this, proposal_t *proposal);
 455
 456         /**
 457          * Set the message id of the IKE_SA.
 458          *
 459          * The IKE_SA stores two message IDs, one for initiating exchanges (send)
 460          * and one to respond to exchanges (expect).
 461          *
 462          * @param initiate              TRUE to set message ID for initiating
 463          * @param mid                   message id to set
 464          */
 465         void (*set_message_id)(ike_sa_t *this, bool initiate, u_int32_t mid);
 466
 467         /**
 468          * Add an additional address for the peer.
 469          *
 470          * In MOBIKE, a peer may transmit additional addresses where it is
 471          * reachable. These are stored in the IKE_SA.
 472          * The own list of addresses is not stored, they are queried from
 473          * the kernel when required.
 474          *
 475          * @param host                  host to add to list
 476          */
 477         void (*add_additional_address)(ike_sa_t *this, host_t *host);
 478
 479         /**
 480          * Create an enumerator over all additional addresses of the peer.
 481          *
 482          * @return                              enumerator over addresses
 483          */
 484         enumerator_t* (*create_additional_address_enumerator)(ike_sa_t *this);
 485
 486         /**
 487          * Remove all additional addresses of the peer.
 488          */
 489         void (*remove_additional_addresses)(ike_sa_t *this);
 490
 491         /**
 492          * Check if mappings have changed on a NAT for our source address.
 493          *
 494          * @param hash                  received DESTINATION_IP hash
 495          * @return                              TRUE if mappings have changed
 496          */
 497         bool (*has_mapping_changed)(ike_sa_t *this, chunk_t hash);
 498
 499         /**
 500          * Enable an extension the peer supports.
 501          *
 502          * If support for an IKE extension is detected, this method is called
 503          * to enable that extension and behave accordingly.
 504          *
 505          * @param extension             extension to enable
 506          */
 507         void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
 508
 509         /**
 510          * Check if the peer supports an extension.
 511          *
 512          * @param extension             extension to check for support
 513          * @return                              TRUE if peer supports it, FALSE otherwise
 514          */
 515         bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
 516
 517         /**
 518          * Enable/disable a condition flag for this IKE_SA.
 519          *
 520          * @param condition             condition to enable/disable
 521          * @param enable                TRUE to enable condition, FALSE to disable
 522          */
 523         void (*set_condition) (ike_sa_t *this, ike_condition_t condition, bool enable);
 524
 525         /**
 526          * Check if a condition flag is set.
 527          *
 528          * @param condition             condition to check
 529          * @return                              TRUE if condition flag set, FALSE otherwise
 530          */
 531         bool (*has_condition) (ike_sa_t *this, ike_condition_t condition);
 532
 533         /**
 534          * Get the number of queued MOBIKE address updates.
 535          *
 536          * @return                              number of pending updates
 537          */
 538         u_int32_t (*get_pending_updates)(ike_sa_t *this);
 539
 540         /**
 541          * Set the number of queued MOBIKE address updates.
 542          *
 543          * @param updates               number of pending updates
 544          */
 545         void (*set_pending_updates)(ike_sa_t *this, u_int32_t updates);
 546
 547 #ifdef ME
 548         /**
 549          * Activate mediation server functionality for this IKE_SA.
 550          */
 551         void (*act_as_mediation_server) (ike_sa_t *this);
 552
 553         /**
 554          * Get the server reflexive host.
 555          *
 556          * @return                              server reflexive host
 557          */
 558         host_t* (*get_server_reflexive_host) (ike_sa_t *this);
 559
 560         /**
 561          * Set the server reflexive host.
 562          *
 563          * @param host                  server reflexive host
 564          */
 565         void (*set_server_reflexive_host) (ike_sa_t *this, host_t *host);
 566
 567         /**
 568          * Get the connect ID.
 569          *
 570          * @return                              connect ID
 571          */
 572         chunk_t (*get_connect_id) (ike_sa_t *this);
 573
 574         /**
 575          * Initiate the mediation of a mediated connection (i.e. initiate a
 576          * ME_CONNECT exchange to a mediation server).
 577          *
 578          * @param mediated_cfg  peer_cfg of the mediated connection
 579          * @return
 580          *                                              - SUCCESS if initialization started
 581          *                                              - DESTROY_ME if initialization failed
 582          */
 583         status_t (*initiate_mediation) (ike_sa_t *this, peer_cfg_t *mediated_cfg);
 584
 585         /**
 586          * Initiate the mediated connection
 587          *
 588          * @param me                    local endpoint (gets cloned)
 589          * @param other                 remote endpoint (gets cloned)
 590          * @param connect_id    connect ID (gets cloned)
 591          * @return
 592          *                                              - SUCCESS if initialization started
 593          *                                              - DESTROY_ME if initialization failed
 594          */
 595         status_t (*initiate_mediated) (ike_sa_t *this, host_t *me, host_t *other,
 596                                                                    chunk_t connect_id);
 597
 598         /**
 599          * Relay data from one peer to another (i.e. initiate a ME_CONNECT exchange
 600          * to a peer).
 601          *
 602          * Data is cloned.
 603          *
 604          * @param requester             ID of the requesting peer
 605          * @param connect_id    data of the ME_CONNECTID payload
 606          * @param connect_key   data of the ME_CONNECTKEY payload
 607          * @param endpoints             endpoints
 608          * @param response              TRUE if this is a response
 609          * @return
 610          *                                              - SUCCESS if relay started
 611          *                                              - DESTROY_ME if relay failed
 612          */
 613         status_t (*relay) (ike_sa_t *this, identification_t *requester,
 614                                            chunk_t connect_id, chunk_t connect_key,
 615                                            linked_list_t *endpoints, bool response);
 616
 617         /**
 618          * Send a callback to a peer.
 619          *
 620          * Data is cloned.
 621          *
 622          * @param peer_id               ID of the other peer
 623          * @return
 624          *                                              - SUCCESS if response started
 625          *                                              - DESTROY_ME if response failed
 626          */
 627         status_t (*callback) (ike_sa_t *this, identification_t *peer_id);
 628
 629         /**
 630          * Respond to a ME_CONNECT request.
 631          *
 632          * Data is cloned.
 633          *
 634          * @param peer_id               ID of the other peer
 635          * @param connect_id    the connect ID supplied by the initiator
 636          * @return
 637          *                                              - SUCCESS if response started
 638          *                                              - DESTROY_ME if response failed
 639          */
 640         status_t (*respond) (ike_sa_t *this, identification_t *peer_id,
 641                                                  chunk_t connect_id);
 642 #endif /* ME */
 643
 644         /**
 645          * Initiate a new connection.
 646          *
 647          * The configs are owned by the IKE_SA after the call. If the initiate
 648          * is triggered by a packet, traffic selectors of the packet can be added
 649          * to the CHILD_SA.
 650          *
 651          * @param child_cfg             child config to create CHILD from
 652          * @param reqid                 reqid to use for CHILD_SA, 0 assigne uniquely
 653          * @param tsi                   source of triggering packet
 654          * @param tsr                   destination of triggering packet.
 655          * @return
 656          *                                              - SUCCESS if initialization started
 657          *                                              - DESTROY_ME if initialization failed
 658          */
 659         status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg,
 660                                                   u_int32_t reqid, traffic_selector_t *tsi,
 661                                                   traffic_selector_t *tsr);
 662
 663         /**
 664          * Initiates the deletion of an IKE_SA.
 665          *
 666          * Sends a delete message to the remote peer and waits for
 667          * its response. If the response comes in, or a timeout occurs,
 668          * the IKE SA gets deleted.
 669          *
 670          * @return
 671          *                                              - SUCCESS if deletion is initialized
 672          *                                              - DESTROY_ME, if the IKE_SA is not in
 673          *                                                an established state and can not be
 674          *                                                deleted (but destroyed).
 675          */
 676         status_t (*delete) (ike_sa_t *this);
 677
 678         /**
 679          * Update IKE_SAs after network interfaces have changed.
 680          *
 681          * Whenever the network interface configuration changes, the kernel
 682          * interface calls roam() on each IKE_SA. The IKE_SA then checks if
 683          * the new network config requires changes, and handles appropriate.
 684          * If MOBIKE is supported, addresses are updated; If not, the tunnel is
 685          * restarted.
 686          *
 687          * @param address               TRUE if address list changed, FALSE otherwise
 688          * @return                              SUCCESS, FAILED, DESTROY_ME
 689          */
 690         status_t (*roam)(ike_sa_t *this, bool address);
 691
 692         /**
 693          * Processes a incoming IKEv2-Message.
 694          *
 695          * Message processing may fail. If a critical failure occurs,
 696          * process_message() return DESTROY_ME. Then the caller must
 697          * destroy the IKE_SA immediately, as it is unusable.
 698          *
 699          * @param message               message to process
 700          * @return
 701          *                                              - SUCCESS
 702          *                                              - FAILED
 703          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 704          */
 705         status_t (*process_message) (ike_sa_t *this, message_t *message);
 706
 707         /**
 708          * Generate a IKE message to send it to the peer.
 709          *
 710          * This method generates all payloads in the message and encrypts/signs
 711          * the packet.
 712          *
 713          * @param message               message to generate
 714          * @param packet                generated output packet
 715          * @return
 716          *                                              - SUCCESS
 717          *                                              - FAILED
 718          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 719          */
 720         status_t (*generate_message) (ike_sa_t *this, message_t *message,
 721                                                                   packet_t **packet);
 722
 723         /**
 724          * Retransmits a request.
 725          *
 726          * @param message_id    ID of the request to retransmit
 727          * @return
 728          *                                              - SUCCESS
 729          *                                              - NOT_FOUND if request doesn't have to be retransmited
 730          */
 731         status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
 732
 733         /**
 734          * Sends a DPD request to the peer.
 735          *
 736          * To check if a peer is still alive, periodic
 737          * empty INFORMATIONAL messages are sent if no
 738          * other traffic was received.
 739          *
 740          * @return
 741          *                                              - SUCCESS
 742          *                                              - DESTROY_ME, if peer did not respond
 743          */
 744         status_t (*send_dpd) (ike_sa_t *this);
 745
 746         /**
 747          * Sends a keep alive packet.
 748          *
 749          * To refresh NAT tables in a NAT router
 750          * between the peers, periodic empty
 751          * UDP packets are sent if no other traffic
 752          * was sent.
 753          */
 754         void (*send_keepalive) (ike_sa_t *this);
 755
 756         /**
 757          * Get the keying material of this IKE_SA.
 758          *
 759          * @return                              per IKE_SA keymat instance
 760          */
 761         keymat_t* (*get_keymat)(ike_sa_t *this);
 762
 763         /**
 764          * Associates a child SA to this IKE SA
 765          *
 766          * @param child_sa              child_sa to add
 767          */
 768         void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
 769
 770         /**
 771          * Get a CHILD_SA identified by protocol and SPI.
 772          *
 773          * @param protocol              protocol of the SA
 774          * @param spi                   SPI of the CHILD_SA
 775          * @param inbound               TRUE if SPI is inbound, FALSE if outbound
 776          * @return                              child_sa, or NULL if none found
 777          */
 778         child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
 779                                                                  u_int32_t spi, bool inbound);
 780
 781         /**
 782          * Get the number of CHILD_SAs.
 783          *
 784          * @return                              number of CHILD_SAs
 785          */
 786         int (*get_child_count) (ike_sa_t *this);
 787
 788         /**
 789          * Create an enumerator over all CHILD_SAs.
 790          *
 791          * @return                              enumerator
 792          */
 793         enumerator_t* (*create_child_sa_enumerator) (ike_sa_t *this);
 794
 795         /**
 796          * Remove the CHILD_SA the given enumerator points to from this IKE_SA.
 797          *
 798          * @param enumerator    enumerator pointing to CHILD_SA
 799          */
 800         void (*remove_child_sa) (ike_sa_t *this, enumerator_t *enumerator);
 801
 802         /**
 803          * Rekey the CHILD SA with the specified reqid.
 804          *
 805          * Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
 806          *
 807          * @param protocol              protocol of the SA
 808          * @param spi                   inbound SPI of the CHILD_SA
 809          * @return
 810          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 811          *                                              - SUCCESS, if rekeying initiated
 812          */
 813         status_t (*rekey_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 814
 815         /**
 816          * Close the CHILD SA with the specified protocol/SPI.
 817          *
 818          * Looks for a CHILD SA owned by this IKE_SA, deletes it and
 819          * notify's the remote peer about the delete. The associated
 820          * states and policies in the kernel get deleted, if they exist.
 821          *
 822          * @param protocol              protocol of the SA
 823          * @param spi                   inbound SPI of the CHILD_SA
 824          * @return
 825          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 826          *                                              - SUCCESS, if delete message sent
 827          */
 828         status_t (*delete_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 829
 830         /**
 831          * Destroy a CHILD SA with the specified protocol/SPI.
 832          *
 833          * Looks for a CHILD SA owned by this IKE_SA and destroys it.
 834          *
 835          * @param protocol              protocol of the SA
 836          * @param spi                   inbound SPI of the CHILD_SA
 837          * @return
 838          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 839          *                                              - SUCCESS
 840          */
 841         status_t (*destroy_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 842
 843         /**
 844          * Rekey the IKE_SA.
 845          *
 846          * Sets up a new IKE_SA, moves all CHILDs to it and deletes this IKE_SA.
 847          *
 848          * @return                              - SUCCESS, if IKE_SA rekeying initiated
 849          */
 850         status_t (*rekey) (ike_sa_t *this);
 851
 852         /**
 853          * Reauthenticate the IKE_SA.
 854          *
 855          * Create a completely new IKE_SA with authentication, recreates all children
 856          * within the IKE_SA, closes this IKE_SA.
 857          *
 858          * @return                              DESTROY_ME to destroy the IKE_SA
 859          */
 860         status_t (*reauth) (ike_sa_t *this);
 861
 862         /**
 863          * Restablish the IKE_SA.
 864          *
 865          * Reestablish an IKE_SA after it has been closed.
 866          *
 867          * @return                              DESTROY_ME to destroy the IKE_SA
 868          */
 869         status_t (*reestablish) (ike_sa_t *this);
 870
 871         /**
 872          * Set the lifetime limit received/to send in a AUTH_LIFETIME notify.
 873          *
 874          * If the IKE_SA is already ESTABLISHED, an INFORMATIONAL is sent with
 875          * an AUTH_LIFETIME notify. The call never fails on unestablished SAs.
 876          *
 877          * @param lifetime              lifetime in seconds
 878          * @return                              DESTROY_ME to destroy the IKE_SA
 879          */
 880         status_t (*set_auth_lifetime)(ike_sa_t *this, u_int32_t lifetime);
 881
 882         /**
 883          * Set the virtual IP to use for this IKE_SA and its children.
 884          *
 885          * The virtual IP is assigned per IKE_SA, not per CHILD_SA. It has the same
 886          * lifetime as the IKE_SA.
 887          *
 888          * @param local                 TRUE to set local address, FALSE for remote
 889          * @param ip                    IP to set as virtual IP
 890          */
 891         void (*set_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
 892
 893         /**
 894          * Get the virtual IP configured.
 895          *
 896          * @param local                 TRUE to get local virtual IP, FALSE for remote
 897          * @return                              host_t *virtual IP
 898          */
 899         host_t* (*get_virtual_ip) (ike_sa_t *this, bool local);
 900
 901         /**
 902          * Register a configuration attribute to the IKE_SA.
 903          *
 904          * If an IRAS sends a configuration attribute it is installed and
 905          * registered at the IKE_SA. Attributes are inherit()ed and get released
 906          * when the IKE_SA is closed.
 907          *
 908          * @param handler               handler installed the attribute, use for release()
 909          * @param type                  configuration attribute type
 910          * @param data                  associated attribute data
 911          */
 912         void (*add_configuration_attribute)(ike_sa_t *this,
 913                                                         attribute_handler_t *handler,
 914                                                         configuration_attribute_type_t type, chunk_t data);
 915
 916         /**
 917          * Set local and remote host addresses to be used for IKE.
 918          *
 919          * These addresses are communicated via the KMADDRESS field of a MIGRATE
 920          * message sent via the NETLINK or PF _KEY kernel socket interface.
 921          *
 922          * @param local                 local kmaddress
 923          * @param remote                remote kmaddress
 924          */
 925         void (*set_kmaddress) (ike_sa_t *this, host_t *local, host_t *remote);
 926
 927         /**
 928          * Create enumerator over a task queue of this IKE_SA.
 929          *
 930          * @param                               queue type to enumerate
 931          * @return                              enumerator over task_t
 932          */
 933         enumerator_t* (*create_task_enumerator)(ike_sa_t *this, task_queue_t queue);
 934
 935         /**
 936          * Inherit all attributes of other to this after rekeying.
 937          *
 938          * When rekeying is completed, all CHILD_SAs, the virtual IP and all
 939          * outstanding tasks are moved from other to this.
 940          * As this call may initiate inherited tasks, a status is returned.
 941          *
 942          * @param other                 other task to inherit from
 943          */
 944         void (*inherit) (ike_sa_t *this, ike_sa_t *other);
 945
 946         /**
 947          * Reset the IKE_SA, useable when initiating fails
 948          */
 949         void (*reset) (ike_sa_t *this);
 950
 951         /**
 952          * Destroys a ike_sa_t object.
 953          */
 954         void (*destroy) (ike_sa_t *this);
 955 };
 956
 957 /**
 958  * Creates an ike_sa_t object with a specific ID.
 959  *
 960  * @param ike_sa_id             ike_sa_id_t object to associate with new IKE_SA
 961  * @return                              ike_sa_t object
 962  */
 963 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id);
 964
 965 #endif /** IKE_SA_H_ @}*/