src/charon/sa/ike_sa.h

   1 /*
   2  * Copyright (C) 2006-2008 Tobias Brunner
   3  * Copyright (C) 2006 Daniel Roethlisberger
   4  * Copyright (C) 2005-2009 Martin Willi
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 /**
  20  * @defgroup ike_sa ike_sa
  21  * @{ @ingroup sa
  22  */
  23
  24 #ifndef IKE_SA_H_
  25 #define IKE_SA_H_
  26
  27 typedef enum ike_extension_t ike_extension_t;
  28 typedef enum ike_condition_t ike_condition_t;
  29 typedef enum ike_sa_state_t ike_sa_state_t;
  30 typedef enum statistic_t statistic_t;
  31 typedef struct ike_sa_t ike_sa_t;
  32
  33 #include <library.h>
  34 #include <encoding/message.h>
  35 #include <encoding/payloads/proposal_substructure.h>
  36 #include <encoding/payloads/configuration_attribute.h>
  37 #include <sa/ike_sa_id.h>
  38 #include <sa/child_sa.h>
  39 #include <sa/tasks/task.h>
  40 #include <sa/keymat.h>
  41 #include <config/peer_cfg.h>
  42 #include <config/ike_cfg.h>
  43 #include <config/auth_cfg.h>
  44
  45 /**
  46  * Timeout in seconds after that a half open IKE_SA gets deleted.
  47  */
  48 #define HALF_OPEN_IKE_SA_TIMEOUT 30
  49
  50 /**
  51  * Interval to send keepalives when NATed, in seconds.
  52  */
  53 #define KEEPALIVE_INTERVAL 20
  54
  55 /**
  56  * After which time rekeying should be retried if it failed, in seconds.
  57  */
  58 #define RETRY_INTERVAL 30
  59
  60 /**
  61  * Jitter to subtract from RETRY_INTERVAL to randomize rekey retry.
  62  */
  63 #define RETRY_JITTER 20
  64
  65 /**
  66  * Extensions (or optional features) the peer supports
  67  */
  68 enum ike_extension_t {
  69
  70         /**
  71          * peer supports NAT traversal as specified in RFC4306
  72          */
  73         EXT_NATT = (1<<0),
  74
  75         /**
  76          * peer supports MOBIKE (RFC4555)
  77          */
  78         EXT_MOBIKE = (1<<1),
  79
  80         /**
  81          * peer supports HTTP cert lookups as specified in RFC4306
  82          */
  83         EXT_HASH_AND_URL = (1<<2),
  84
  85         /**
  86          * peer supports multiple authentication exchanges, RFC4739
  87          */
  88         EXT_MULTIPLE_AUTH = (1<<3),
  89 };
  90
  91 /**
  92  * Conditions of an IKE_SA, change during its lifetime
  93  */
  94 enum ike_condition_t {
  95
  96         /**
  97          * Connection is natted (or faked) somewhere
  98          */
  99         COND_NAT_ANY = (1<<0),
 100
 101         /**
 102          * we are behind NAT
 103          */
 104         COND_NAT_HERE = (1<<1),
 105
 106         /**
 107          * other is behind NAT
 108          */
 109         COND_NAT_THERE = (1<<2),
 110
 111         /**
 112          * Faking NAT to enforce UDP encapsulation
 113          */
 114         COND_NAT_FAKE = (1<<3),
 115
 116         /**
 117          * peer has been authenticated using EAP at least once
 118          */
 119         COND_EAP_AUTHENTICATED = (1<<4),
 120
 121         /**
 122          * received a certificate request from the peer
 123          */
 124         COND_CERTREQ_SEEN = (1<<5),
 125
 126         /**
 127          * Local peer is the "original" IKE initiator. Unaffected from rekeying.
 128          */
 129         COND_ORIGINAL_INITIATOR = (1<<6),
 130
 131         /**
 132          * IKE_SA is stale, the peer is currently unreachable (MOBIKE)
 133          */
 134         COND_STALE = (1<<7),
 135 };
 136
 137 /**
 138  * Timing information and statistics to query from an SA
 139  */
 140 enum statistic_t {
 141         /** Timestamp of SA establishement */
 142         STAT_ESTABLISHED = 0,
 143         /** Timestamp of scheudled rekeying */
 144         STAT_REKEY,
 145         /** Timestamp of scheudled reauthentication */
 146         STAT_REAUTH,
 147         /** Timestamp of scheudled delete */
 148         STAT_DELETE,
 149         /** Timestamp of last inbound IKE packet */
 150         STAT_INBOUND,
 151         /** Timestamp of last outbound IKE packet */
 152         STAT_OUTBOUND,
 153
 154         STAT_MAX
 155 };
 156
 157 /**
 158  * State of an IKE_SA.
 159  *
 160  * An IKE_SA passes various states in its lifetime. A newly created
 161  * SA is in the state CREATED.
 162  * @verbatim
 163                  +----------------+
 164                  ¦   SA_CREATED   ¦
 165                  +----------------+
 166                          ¦
 167     on initiate()--->    ¦   <----- on IKE_SA_INIT received
 168                          V
 169                  +----------------+
 170                  ¦ SA_CONNECTING  ¦
 171                  +----------------+
 172                          ¦
 173                          ¦   <----- on IKE_AUTH successfully completed
 174                          V
 175                  +----------------+
 176                  ¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
 177                  +----------------+                         ¦
 178                          ¦                                  V
 179     on delete()--->      ¦   <----- on IKE_SA        +-------------+
 180                          ¦          delete request   ¦ SA_REKEYING ¦
 181                          ¦          received         +-------------+
 182                          V                                  ¦
 183                  +----------------+                         ¦
 184                  ¦  SA_DELETING   ¦<------------------------+ <-- after rekeying
 185                  +----------------+
 186                          ¦
 187                          ¦   <----- after delete() acknowledged
 188                          ¦
 189                         \V/
 190                          X
 191                         / \
 192    @endverbatim
 193  */
 194 enum ike_sa_state_t {
 195
 196         /**
 197          * IKE_SA just got created, but is not initiating nor responding yet.
 198          */
 199         IKE_CREATED,
 200
 201         /**
 202          * IKE_SA gets initiated actively or passively
 203          */
 204         IKE_CONNECTING,
 205
 206         /**
 207          * IKE_SA is fully established
 208          */
 209         IKE_ESTABLISHED,
 210
 211         /**
 212          * IKE_SA is managed externally and does not process messages
 213          */
 214         IKE_PASSIVE,
 215
 216         /**
 217          * IKE_SA rekeying in progress
 218          */
 219         IKE_REKEYING,
 220
 221         /**
 222          * IKE_SA is in progress of deletion
 223          */
 224         IKE_DELETING,
 225
 226         /**
 227          * IKE_SA object gets destroyed
 228          */
 229         IKE_DESTROYING,
 230 };
 231
 232 /**
 233  * enum names for ike_sa_state_t.
 234  */
 235 extern enum_name_t *ike_sa_state_names;
 236
 237 /**
 238  * Class ike_sa_t representing an IKE_SA.
 239  *
 240  * An IKE_SA contains crypto information related to a connection
 241  * with a peer. It contains multiple IPsec CHILD_SA, for which
 242  * it is responsible. All traffic is handled by an IKE_SA, using
 243  * the task manager and its tasks.
 244  */
 245 struct ike_sa_t {
 246
 247         /**
 248          * Get the id of the SA.
 249          *
 250          * Returned ike_sa_id_t object is not getting cloned!
 251          *
 252          * @return                              ike_sa's ike_sa_id_t
 253          */
 254         ike_sa_id_t* (*get_id) (ike_sa_t *this);
 255
 256         /**
 257          * Get the numerical ID uniquely defining this IKE_SA.
 258          *
 259          * @return                              unique ID
 260          */
 261         u_int32_t (*get_unique_id) (ike_sa_t *this);
 262
 263         /**
 264          * Get the state of the IKE_SA.
 265          *
 266          * @return                              state of the IKE_SA
 267          */
 268         ike_sa_state_t (*get_state) (ike_sa_t *this);
 269
 270         /**
 271          * Set the state of the IKE_SA.
 272          *
 273          * @param state                 state to set for the IKE_SA
 274          */
 275         void (*set_state) (ike_sa_t *this, ike_sa_state_t ike_sa);
 276
 277         /**
 278          * Get the name of the connection this IKE_SA uses.
 279          *
 280          * @return                              name
 281          */
 282         char* (*get_name) (ike_sa_t *this);
 283
 284         /**
 285          * Get statistic values from the IKE_SA.
 286          *
 287          * @param kind                  kind of requested value
 288          * @return                              value as integer
 289          */
 290         u_int32_t (*get_statistic)(ike_sa_t *this, statistic_t kind);
 291
 292         /**
 293          * Get the own host address.
 294          *
 295          * @return                              host address
 296          */
 297         host_t* (*get_my_host) (ike_sa_t *this);
 298
 299         /**
 300          * Set the own host address.
 301          *
 302          * @param me                    host address
 303          */
 304         void (*set_my_host) (ike_sa_t *this, host_t *me);
 305
 306         /**
 307          * Get the other peers host address.
 308          *
 309          * @return                              host address
 310          */
 311         host_t* (*get_other_host) (ike_sa_t *this);
 312
 313         /**
 314          * Set the others host address.
 315          *
 316          * @param other                 host address
 317          */
 318         void (*set_other_host) (ike_sa_t *this, host_t *other);
 319
 320         /**
 321          * Update the IKE_SAs host.
 322          *
 323          * Hosts may be NULL to use current host.
 324          *
 325          * @param me                    new local host address, or NULL
 326          * @param other                 new remote host address, or NULL
 327          */
 328         void (*update_hosts)(ike_sa_t *this, host_t *me, host_t *other);
 329
 330         /**
 331          * Get the own identification.
 332          *
 333          * @return                              identification
 334          */
 335         identification_t* (*get_my_id) (ike_sa_t *this);
 336
 337         /**
 338          * Set the own identification.
 339          *
 340          * @param me                    identification
 341          */
 342         void (*set_my_id) (ike_sa_t *this, identification_t *me);
 343
 344         /**
 345          * Get the other peer's identification.
 346          *
 347          * @return                              identification
 348          */
 349         identification_t* (*get_other_id) (ike_sa_t *this);
 350
 351         /**
 352          * Set the other peer's identification.
 353          *
 354          * @param other                 identification
 355          */
 356         void (*set_other_id) (ike_sa_t *this, identification_t *other);
 357
 358         /**
 359          * Get the config used to setup this IKE_SA.
 360          *
 361          * @return                              ike_config
 362          */
 363         ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
 364
 365         /**
 366          * Set the config to setup this IKE_SA.
 367          *
 368          * @param config                ike_config to use
 369          */
 370         void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
 371
 372         /**
 373          * Get the peer config used by this IKE_SA.
 374          *
 375          * @return                              peer_config
 376          */
 377         peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
 378
 379         /**
 380          * Set the peer config to use with this IKE_SA.
 381          *
 382          * @param config                peer_config to use
 383          */
 384         void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
 385
 386         /**
 387          * Get the authentication config with rules of the current auth round.
 388          *
 389          * @param local                 TRUE for local rules, FALSE for remote constraints
 390          * @return                              current cfg
 391          */
 392         auth_cfg_t* (*get_auth_cfg)(ike_sa_t *this, bool local);
 393
 394         /**
 395          * Insert a completed authentication round.
 396          *
 397          * @param local                 TRUE for own rules, FALSE for others constraints
 398          * @param cfg                   auth config to append
 399          */
 400         void (*add_auth_cfg)(ike_sa_t *this, bool local, auth_cfg_t *cfg);
 401
 402         /**
 403          * Create an enumerator over added authentication rounds.
 404          *
 405          * @param local                 TRUE for own rules, FALSE for others constraints
 406          * @return                              enumerator over auth_cfg_t
 407          */
 408         enumerator_t* (*create_auth_cfg_enumerator)(ike_sa_t *this, bool local);
 409
 410         /**
 411          * Get the selected proposal of this IKE_SA.
 412          *
 413          * @return                              selected proposal
 414          */
 415         proposal_t* (*get_proposal)(ike_sa_t *this);
 416
 417         /**
 418          * Set the proposal selected for this IKE_SA.
 419          *
 420          * @param                               selected proposal
 421          */
 422         void (*set_proposal)(ike_sa_t *this, proposal_t *proposal);
 423
 424         /**
 425          * Set the message id of the IKE_SA.
 426          *
 427          * The IKE_SA stores two message IDs, one for initiating exchanges (send)
 428          * and one to respond to exchanges (expect).
 429          *
 430          * @param initiate              TRUE to set message ID for initiating
 431          * @param mid                   message id to set
 432          */
 433         void (*set_message_id)(ike_sa_t *this, bool initiate, u_int32_t mid);
 434
 435         /**
 436          * Add an additional address for the peer.
 437          *
 438          * In MOBIKE, a peer may transmit additional addresses where it is
 439          * reachable. These are stored in the IKE_SA.
 440          * The own list of addresses is not stored, they are queried from
 441          * the kernel when required.
 442          *
 443          * @param host                  host to add to list
 444          */
 445         void (*add_additional_address)(ike_sa_t *this, host_t *host);
 446
 447         /**
 448          * Create an iterator over all additional addresses of the peer.
 449          *
 450          * @return                              iterator over addresses
 451          */
 452         iterator_t* (*create_additional_address_iterator)(ike_sa_t *this);
 453
 454         /**
 455          * Check if mappings have changed on a NAT for our source address.
 456          *
 457          * @param hash                  received DESTINATION_IP hash
 458          * @return                              TRUE if mappings have changed
 459          */
 460         bool (*has_mapping_changed)(ike_sa_t *this, chunk_t hash);
 461
 462         /**
 463          * Enable an extension the peer supports.
 464          *
 465          * If support for an IKE extension is detected, this method is called
 466          * to enable that extension and behave accordingly.
 467          *
 468          * @param extension             extension to enable
 469          */
 470         void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
 471
 472         /**
 473          * Check if the peer supports an extension.
 474          *
 475          * @param extension             extension to check for support
 476          * @return                              TRUE if peer supports it, FALSE otherwise
 477          */
 478         bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
 479
 480         /**
 481          * Enable/disable a condition flag for this IKE_SA.
 482          *
 483          * @param condition             condition to enable/disable
 484          * @param enable                TRUE to enable condition, FALSE to disable
 485          */
 486         void (*set_condition) (ike_sa_t *this, ike_condition_t condition, bool enable);
 487
 488         /**
 489          * Check if a condition flag is set.
 490          *
 491          * @param condition             condition to check
 492          * @return                              TRUE if condition flag set, FALSE otherwise
 493          */
 494         bool (*has_condition) (ike_sa_t *this, ike_condition_t condition);
 495
 496         /**
 497          * Get the number of queued MOBIKE address updates.
 498          *
 499          * @return                              number of pending updates
 500          */
 501         u_int32_t (*get_pending_updates)(ike_sa_t *this);
 502
 503         /**
 504          * Set the number of queued MOBIKE address updates.
 505          *
 506          * @param updates               number of pending updates
 507          */
 508         void (*set_pending_updates)(ike_sa_t *this, u_int32_t updates);
 509
 510 #ifdef ME
 511         /**
 512          * Activate mediation server functionality for this IKE_SA.
 513          */
 514         void (*act_as_mediation_server) (ike_sa_t *this);
 515
 516         /**
 517          * Get the server reflexive host.
 518          *
 519          * @return                              server reflexive host
 520          */
 521         host_t* (*get_server_reflexive_host) (ike_sa_t *this);
 522
 523         /**
 524          * Set the server reflexive host.
 525          *
 526          * @param host                  server reflexive host
 527          */
 528         void (*set_server_reflexive_host) (ike_sa_t *this, host_t *host);
 529
 530         /**
 531          * Get the connect ID.
 532          *
 533          * @return                              connect ID
 534          */
 535         chunk_t (*get_connect_id) (ike_sa_t *this);
 536
 537         /**
 538          * Initiate the mediation of a mediated connection (i.e. initiate a
 539          * ME_CONNECT exchange to a mediation server).
 540          *
 541          * @param mediated_cfg  peer_cfg of the mediated connection
 542          * @return
 543          *                                              - SUCCESS if initialization started
 544          *                                              - DESTROY_ME if initialization failed
 545          */
 546         status_t (*initiate_mediation) (ike_sa_t *this, peer_cfg_t *mediated_cfg);
 547
 548         /**
 549          * Initiate the mediated connection
 550          *
 551          * @param me                    local endpoint (gets cloned)
 552          * @param other                 remote endpoint (gets cloned)
 553          * @param connect_id    connect ID (gets cloned)
 554          * @return
 555          *                                              - SUCCESS if initialization started
 556          *                                              - DESTROY_ME if initialization failed
 557          */
 558         status_t (*initiate_mediated) (ike_sa_t *this, host_t *me, host_t *other,
 559                                                                    chunk_t connect_id);
 560
 561         /**
 562          * Relay data from one peer to another (i.e. initiate a ME_CONNECT exchange
 563          * to a peer).
 564          *
 565          * Data is cloned.
 566          *
 567          * @param requester             ID of the requesting peer
 568          * @param connect_id    data of the ME_CONNECTID payload
 569          * @param connect_key   data of the ME_CONNECTKEY payload
 570          * @param endpoints             endpoints
 571          * @param response              TRUE if this is a response
 572          * @return
 573          *                                              - SUCCESS if relay started
 574          *                                              - DESTROY_ME if relay failed
 575          */
 576         status_t (*relay) (ike_sa_t *this, identification_t *requester,
 577                                            chunk_t connect_id, chunk_t connect_key,
 578                                            linked_list_t *endpoints, bool response);
 579
 580         /**
 581          * Send a callback to a peer.
 582          *
 583          * Data is cloned.
 584          *
 585          * @param peer_id               ID of the other peer
 586          * @return
 587          *                                              - SUCCESS if response started
 588          *                                              - DESTROY_ME if response failed
 589          */
 590         status_t (*callback) (ike_sa_t *this, identification_t *peer_id);
 591
 592         /**
 593          * Respond to a ME_CONNECT request.
 594          *
 595          * Data is cloned.
 596          *
 597          * @param peer_id               ID of the other peer
 598          * @param connect_id    the connect ID supplied by the initiator
 599          * @return
 600          *                                              - SUCCESS if response started
 601          *                                              - DESTROY_ME if response failed
 602          */
 603         status_t (*respond) (ike_sa_t *this, identification_t *peer_id,
 604                                                  chunk_t connect_id);
 605 #endif /* ME */
 606
 607         /**
 608          * Initiate a new connection.
 609          *
 610          * The configs are owned by the IKE_SA after the call. If the initiate
 611          * is triggered by a packet, traffic selectors of the packet can be added
 612          * to the CHILD_SA.
 613          *
 614          * @param child_cfg             child config to create CHILD from
 615          * @param reqid                 reqid to use for CHILD_SA, 0 assigne uniquely
 616          * @param tsi                   source of triggering packet
 617          * @param tsr                   destination of triggering packet.
 618          * @return
 619          *                                              - SUCCESS if initialization started
 620          *                                              - DESTROY_ME if initialization failed
 621          */
 622         status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg,
 623                                                   u_int32_t reqid, traffic_selector_t *tsi,
 624                                                   traffic_selector_t *tsr);
 625
 626         /**
 627          * Initiates the deletion of an IKE_SA.
 628          *
 629          * Sends a delete message to the remote peer and waits for
 630          * its response. If the response comes in, or a timeout occurs,
 631          * the IKE SA gets deleted.
 632          *
 633          * @return
 634          *                                              - SUCCESS if deletion is initialized
 635          *                                              - DESTROY_ME, if the IKE_SA is not in
 636          *                                                an established state and can not be
 637          *                                                deleted (but destroyed).
 638          */
 639         status_t (*delete) (ike_sa_t *this);
 640
 641         /**
 642          * Update IKE_SAs after network interfaces have changed.
 643          *
 644          * Whenever the network interface configuration changes, the kernel
 645          * interface calls roam() on each IKE_SA. The IKE_SA then checks if
 646          * the new network config requires changes, and handles appropriate.
 647          * If MOBIKE is supported, addresses are updated; If not, the tunnel is
 648          * restarted.
 649          *
 650          * @param address               TRUE if address list changed, FALSE otherwise
 651          * @return                              SUCCESS, FAILED, DESTROY_ME
 652          */
 653         status_t (*roam)(ike_sa_t *this, bool address);
 654
 655         /**
 656          * Processes a incoming IKEv2-Message.
 657          *
 658          * Message processing may fail. If a critical failure occurs,
 659          * process_message() return DESTROY_ME. Then the caller must
 660          * destroy the IKE_SA immediatly, as it is unusable.
 661          *
 662          * @param message               message to process
 663          * @return
 664          *                                              - SUCCESS
 665          *                                              - FAILED
 666          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 667          */
 668         status_t (*process_message) (ike_sa_t *this, message_t *message);
 669
 670         /**
 671          * Generate a IKE message to send it to the peer.
 672          *
 673          * This method generates all payloads in the message and encrypts/signs
 674          * the packet.
 675          *
 676          * @param message               message to generate
 677          * @param packet                generated output packet
 678          * @return
 679          *                                              - SUCCESS
 680          *                                              - FAILED
 681          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 682          */
 683         status_t (*generate_message) (ike_sa_t *this, message_t *message,
 684                                                                   packet_t **packet);
 685
 686         /**
 687          * Retransmits a request.
 688          *
 689          * @param message_id    ID of the request to retransmit
 690          * @return
 691          *                                              - SUCCESS
 692          *                                              - NOT_FOUND if request doesn't have to be retransmited
 693          */
 694         status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
 695
 696         /**
 697          * Sends a DPD request to the peer.
 698          *
 699          * To check if a peer is still alive, periodic
 700          * empty INFORMATIONAL messages are sent if no
 701          * other traffic was received.
 702          *
 703          * @return
 704          *                                              - SUCCESS
 705          *                                              - DESTROY_ME, if peer did not respond
 706          */
 707         status_t (*send_dpd) (ike_sa_t *this);
 708
 709         /**
 710          * Sends a keep alive packet.
 711          *
 712          * To refresh NAT tables in a NAT router
 713          * between the peers, periodic empty
 714          * UDP packets are sent if no other traffic
 715          * was sent.
 716          */
 717         void (*send_keepalive) (ike_sa_t *this);
 718
 719         /**
 720          * Get the keying material of this IKE_SA.
 721          *
 722          * @return                              per IKE_SA keymat instance
 723          */
 724         keymat_t* (*get_keymat)(ike_sa_t *this);
 725
 726         /**
 727          * Associates a child SA to this IKE SA
 728          *
 729          * @param child_sa              child_sa to add
 730          */
 731         void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
 732
 733         /**
 734          * Get a CHILD_SA identified by protocol and SPI.
 735          *
 736          * @param protocol              protocol of the SA
 737          * @param spi                   SPI of the CHILD_SA
 738          * @param inbound               TRUE if SPI is inbound, FALSE if outbound
 739          * @return                              child_sa, or NULL if none found
 740          */
 741         child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
 742                                                                  u_int32_t spi, bool inbound);
 743
 744         /**
 745          * Create an iterator over all CHILD_SAs.
 746          *
 747          * @return                              iterator
 748          */
 749         iterator_t* (*create_child_sa_iterator) (ike_sa_t *this);
 750
 751         /**
 752          * Rekey the CHILD SA with the specified reqid.
 753          *
 754          * Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
 755          *
 756          * @param protocol              protocol of the SA
 757          * @param spi                   inbound SPI of the CHILD_SA
 758          * @return
 759          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 760          *                                              - SUCCESS, if rekeying initiated
 761          */
 762         status_t (*rekey_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 763
 764         /**
 765          * Close the CHILD SA with the specified protocol/SPI.
 766          *
 767          * Looks for a CHILD SA owned by this IKE_SA, deletes it and
 768          * notify's the remote peer about the delete. The associated
 769          * states and policies in the kernel get deleted, if they exist.
 770          *
 771          * @param protocol              protocol of the SA
 772          * @param spi                   inbound SPI of the CHILD_SA
 773          * @return
 774          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 775          *                                              - SUCCESS, if delete message sent
 776          */
 777         status_t (*delete_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 778
 779         /**
 780          * Destroy a CHILD SA with the specified protocol/SPI.
 781          *
 782          * Looks for a CHILD SA owned by this IKE_SA and destroys it.
 783          *
 784          * @param protocol              protocol of the SA
 785          * @param spi                   inbound SPI of the CHILD_SA
 786          * @return
 787          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 788          *                                              - SUCCESS
 789          */
 790         status_t (*destroy_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 791
 792         /**
 793          * Rekey the IKE_SA.
 794          *
 795          * Sets up a new IKE_SA, moves all CHILDs to it and deletes this IKE_SA.
 796          *
 797          * @return                              - SUCCESS, if IKE_SA rekeying initiated
 798          */
 799         status_t (*rekey) (ike_sa_t *this);
 800
 801         /**
 802          * Reauthenticate the IKE_SA.
 803          *
 804          * Create a completely new IKE_SA with authentication, recreates all children
 805          * within the IKE_SA, closes this IKE_SA.
 806          *
 807          * @return                              DESTROY_ME to destroy the IKE_SA
 808          */
 809         status_t (*reauth) (ike_sa_t *this);
 810
 811         /**
 812          * Restablish the IKE_SA.
 813          *
 814          * Reestablish an IKE_SA after it has been closed.
 815          *
 816          * @return                              DESTROY_ME to destroy the IKE_SA
 817          */
 818         status_t (*reestablish) (ike_sa_t *this);
 819
 820         /**
 821          * Set the lifetime limit received from a AUTH_LIFETIME notify.
 822          *
 823          * @param lifetime              lifetime in seconds
 824          */
 825         void (*set_auth_lifetime)(ike_sa_t *this, u_int32_t lifetime);
 826
 827         /**
 828          * Set the virtual IP to use for this IKE_SA and its children.
 829          *
 830          * The virtual IP is assigned per IKE_SA, not per CHILD_SA. It has the same
 831          * lifetime as the IKE_SA.
 832          *
 833          * @param local                 TRUE to set local address, FALSE for remote
 834          * @param ip                    IP to set as virtual IP
 835          */
 836         void (*set_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
 837
 838         /**
 839          * Get the virtual IP configured.
 840          *
 841          * @param local                 TRUE to get local virtual IP, FALSE for remote
 842          * @return                              host_t *virtual IP
 843          */
 844         host_t* (*get_virtual_ip) (ike_sa_t *this, bool local);
 845
 846         /**
 847          * Register a configuration attribute to the IKE_SA.
 848          *
 849          * If an IRAS sends a configuration attribute it is installed and
 850          * registered at the IKE_SA. Attributes are inherit()ed and get released
 851          * when the IKE_SA is closed.
 852          *
 853          * @param handler               handler installed the attribute, use for release()
 854          * @param type                  configuration attribute type
 855          * @param data                  associated attribute data
 856          */
 857         void (*add_configuration_attribute)(ike_sa_t *this,
 858                                                         attribute_handler_t *handler,
 859                                                         configuration_attribute_type_t type, chunk_t data);
 860
 861         /**
 862          * Set local and remote host addresses to be used for IKE.
 863          *
 864          * These addresses are communicated via the KMADDRESS field of a MIGRATE
 865          * message sent via the NETLINK or PF _KEY kernel socket interface.
 866          *
 867          * @param local                 local kmaddress
 868          * @param remote                remote kmaddress
 869          */
 870         void (*set_kmaddress) (ike_sa_t *this, host_t *local, host_t *remote);
 871
 872         /**
 873          * Inherit all attributes of other to this after rekeying.
 874          *
 875          * When rekeying is completed, all CHILD_SAs, the virtual IP and all
 876          * outstanding tasks are moved from other to this.
 877          * As this call may initiate inherited tasks, a status is returned.
 878          *
 879          * @param other                 other task to inherit from
 880          * @return                              DESTROY_ME if initiation of inherited task failed
 881          */
 882         status_t (*inherit) (ike_sa_t *this, ike_sa_t *other);
 883
 884         /**
 885          * Reset the IKE_SA, useable when initiating fails
 886          */
 887         void (*reset) (ike_sa_t *this);
 888
 889         /**
 890          * Destroys a ike_sa_t object.
 891          */
 892         void (*destroy) (ike_sa_t *this);
 893 };
 894
 895 /**
 896  * Creates an ike_sa_t object with a specific ID.
 897  *
 898  * @param ike_sa_id     ike_sa_id_t object to associate with new IKE_SA
 899  * @return                              ike_sa_t object
 900  */
 901 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id);
 902
 903 #endif /** IKE_SA_H_ @}*/