src/libcharon/sa/ike_sa.h

   1 /*
   2  * Copyright (C) 2006-2008 Tobias Brunner
   3  * Copyright (C) 2006 Daniel Roethlisberger
   4  * Copyright (C) 2005-2009 Martin Willi
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 /**
  20  * @defgroup ike_sa ike_sa
  21  * @{ @ingroup sa
  22  */
  23
  24 #ifndef IKE_SA_H_
  25 #define IKE_SA_H_
  26
  27 typedef enum ike_extension_t ike_extension_t;
  28 typedef enum ike_condition_t ike_condition_t;
  29 typedef enum ike_sa_state_t ike_sa_state_t;
  30 typedef enum statistic_t statistic_t;
  31 typedef struct ike_sa_t ike_sa_t;
  32
  33 #include <library.h>
  34 #include <attributes/attribute_handler.h>
  35 #include <encoding/message.h>
  36 #include <encoding/payloads/proposal_substructure.h>
  37 #include <encoding/payloads/configuration_attribute.h>
  38 #include <sa/ike_sa_id.h>
  39 #include <sa/child_sa.h>
  40 #include <sa/task_manager.h>
  41 #include <sa/keymat.h>
  42 #include <config/peer_cfg.h>
  43 #include <config/ike_cfg.h>
  44 #include <credentials/auth_cfg.h>
  45
  46 /**
  47  * Timeout in seconds after that a half open IKE_SA gets deleted.
  48  */
  49 #define HALF_OPEN_IKE_SA_TIMEOUT 30
  50
  51 /**
  52  * Interval to send keepalives when NATed, in seconds.
  53  */
  54 #define KEEPALIVE_INTERVAL 20
  55
  56 /**
  57  * After which time rekeying should be retried if it failed, in seconds.
  58  */
  59 #define RETRY_INTERVAL 30
  60
  61 /**
  62  * Jitter to subtract from RETRY_INTERVAL to randomize rekey retry.
  63  */
  64 #define RETRY_JITTER 20
  65
  66 /**
  67  * Extensions (or optional features) the peer supports
  68  */
  69 enum ike_extension_t {
  70
  71         /**
  72          * peer supports NAT traversal as specified in RFC4306
  73          */
  74         EXT_NATT = (1<<0),
  75
  76         /**
  77          * peer supports MOBIKE (RFC4555)
  78          */
  79         EXT_MOBIKE = (1<<1),
  80
  81         /**
  82          * peer supports HTTP cert lookups as specified in RFC4306
  83          */
  84         EXT_HASH_AND_URL = (1<<2),
  85
  86         /**
  87          * peer supports multiple authentication exchanges, RFC4739
  88          */
  89         EXT_MULTIPLE_AUTH = (1<<3),
  90
  91         /**
  92          * peer uses strongSwan, accept private use extensions
  93          */
  94         EXT_STRONGSWAN = (1<<4),
  95
  96         /**
  97          * peer supports EAP-only authentication, draft-eronen-ipsec-ikev2-eap-auth
  98          */
  99         EXT_EAP_ONLY_AUTHENTICATION = (1<<5),
 100 };
 101
 102 /**
 103  * Conditions of an IKE_SA, change during its lifetime
 104  */
 105 enum ike_condition_t {
 106
 107         /**
 108          * Connection is natted (or faked) somewhere
 109          */
 110         COND_NAT_ANY = (1<<0),
 111
 112         /**
 113          * we are behind NAT
 114          */
 115         COND_NAT_HERE = (1<<1),
 116
 117         /**
 118          * other is behind NAT
 119          */
 120         COND_NAT_THERE = (1<<2),
 121
 122         /**
 123          * Faking NAT to enforce UDP encapsulation
 124          */
 125         COND_NAT_FAKE = (1<<3),
 126
 127         /**
 128          * peer has been authenticated using EAP at least once
 129          */
 130         COND_EAP_AUTHENTICATED = (1<<4),
 131
 132         /**
 133          * received a certificate request from the peer
 134          */
 135         COND_CERTREQ_SEEN = (1<<5),
 136
 137         /**
 138          * Local peer is the "original" IKE initiator. Unaffected from rekeying.
 139          */
 140         COND_ORIGINAL_INITIATOR = (1<<6),
 141
 142         /**
 143          * IKE_SA is stale, the peer is currently unreachable (MOBIKE)
 144          */
 145         COND_STALE = (1<<7),
 146 };
 147
 148 /**
 149  * Timing information and statistics to query from an SA
 150  */
 151 enum statistic_t {
 152         /** Timestamp of SA establishement */
 153         STAT_ESTABLISHED = 0,
 154         /** Timestamp of scheudled rekeying */
 155         STAT_REKEY,
 156         /** Timestamp of scheudled reauthentication */
 157         STAT_REAUTH,
 158         /** Timestamp of scheudled delete */
 159         STAT_DELETE,
 160         /** Timestamp of last inbound IKE packet */
 161         STAT_INBOUND,
 162         /** Timestamp of last outbound IKE packet */
 163         STAT_OUTBOUND,
 164
 165         STAT_MAX
 166 };
 167
 168 /**
 169  * State of an IKE_SA.
 170  *
 171  * An IKE_SA passes various states in its lifetime. A newly created
 172  * SA is in the state CREATED.
 173  * @verbatim
 174                  +----------------+
 175                  ¦   SA_CREATED   ¦
 176                  +----------------+
 177                          ¦
 178     on initiate()--->    ¦   <----- on IKE_SA_INIT received
 179                          V
 180                  +----------------+
 181                  ¦ SA_CONNECTING  ¦
 182                  +----------------+
 183                          ¦
 184                          ¦   <----- on IKE_AUTH successfully completed
 185                          V
 186                  +----------------+
 187                  ¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
 188                  +----------------+                         ¦
 189                          ¦                                  V
 190     on delete()--->      ¦   <----- on IKE_SA        +-------------+
 191                          ¦          delete request   ¦ SA_REKEYING ¦
 192                          ¦          received         +-------------+
 193                          V                                  ¦
 194                  +----------------+                         ¦
 195                  ¦  SA_DELETING   ¦<------------------------+ <-- after rekeying
 196                  +----------------+
 197                          ¦
 198                          ¦   <----- after delete() acknowledged
 199                          ¦
 200                         \V/
 201                          X
 202                         / \
 203    @endverbatim
 204  */
 205 enum ike_sa_state_t {
 206
 207         /**
 208          * IKE_SA just got created, but is not initiating nor responding yet.
 209          */
 210         IKE_CREATED,
 211
 212         /**
 213          * IKE_SA gets initiated actively or passively
 214          */
 215         IKE_CONNECTING,
 216
 217         /**
 218          * IKE_SA is fully established
 219          */
 220         IKE_ESTABLISHED,
 221
 222         /**
 223          * IKE_SA is managed externally and does not process messages
 224          */
 225         IKE_PASSIVE,
 226
 227         /**
 228          * IKE_SA rekeying in progress
 229          */
 230         IKE_REKEYING,
 231
 232         /**
 233          * IKE_SA is in progress of deletion
 234          */
 235         IKE_DELETING,
 236
 237         /**
 238          * IKE_SA object gets destroyed
 239          */
 240         IKE_DESTROYING,
 241 };
 242
 243 /**
 244  * enum names for ike_sa_state_t.
 245  */
 246 extern enum_name_t *ike_sa_state_names;
 247
 248 /**
 249  * Class ike_sa_t representing an IKE_SA.
 250  *
 251  * An IKE_SA contains crypto information related to a connection
 252  * with a peer. It contains multiple IPsec CHILD_SA, for which
 253  * it is responsible. All traffic is handled by an IKE_SA, using
 254  * the task manager and its tasks.
 255  */
 256 struct ike_sa_t {
 257
 258         /**
 259          * Get the id of the SA.
 260          *
 261          * Returned ike_sa_id_t object is not getting cloned!
 262          *
 263          * @return                              ike_sa's ike_sa_id_t
 264          */
 265         ike_sa_id_t* (*get_id) (ike_sa_t *this);
 266
 267         /**
 268          * Get the numerical ID uniquely defining this IKE_SA.
 269          *
 270          * @return                              unique ID
 271          */
 272         u_int32_t (*get_unique_id) (ike_sa_t *this);
 273
 274         /**
 275          * Get the state of the IKE_SA.
 276          *
 277          * @return                              state of the IKE_SA
 278          */
 279         ike_sa_state_t (*get_state) (ike_sa_t *this);
 280
 281         /**
 282          * Set the state of the IKE_SA.
 283          *
 284          * @param state                 state to set for the IKE_SA
 285          */
 286         void (*set_state) (ike_sa_t *this, ike_sa_state_t ike_sa);
 287
 288         /**
 289          * Get the name of the connection this IKE_SA uses.
 290          *
 291          * @return                              name
 292          */
 293         char* (*get_name) (ike_sa_t *this);
 294
 295         /**
 296          * Get statistic values from the IKE_SA.
 297          *
 298          * @param kind                  kind of requested value
 299          * @return                              value as integer
 300          */
 301         u_int32_t (*get_statistic)(ike_sa_t *this, statistic_t kind);
 302
 303         /**
 304          * Get the own host address.
 305          *
 306          * @return                              host address
 307          */
 308         host_t* (*get_my_host) (ike_sa_t *this);
 309
 310         /**
 311          * Set the own host address.
 312          *
 313          * @param me                    host address
 314          */
 315         void (*set_my_host) (ike_sa_t *this, host_t *me);
 316
 317         /**
 318          * Get the other peers host address.
 319          *
 320          * @return                              host address
 321          */
 322         host_t* (*get_other_host) (ike_sa_t *this);
 323
 324         /**
 325          * Set the others host address.
 326          *
 327          * @param other                 host address
 328          */
 329         void (*set_other_host) (ike_sa_t *this, host_t *other);
 330
 331         /**
 332          * Float to port 4500 (e.g. if a NAT is detected).
 333          *
 334          * The port of either endpoint is changed only if it is currently
 335          * set to the default value of 500.
 336          */
 337         void (*float_ports)(ike_sa_t *this);
 338
 339         /**
 340          * Update the IKE_SAs host.
 341          *
 342          * Hosts may be NULL to use current host.
 343          *
 344          * @param me                    new local host address, or NULL
 345          * @param other                 new remote host address, or NULL
 346          */
 347         void (*update_hosts)(ike_sa_t *this, host_t *me, host_t *other);
 348
 349         /**
 350          * Get the own identification.
 351          *
 352          * @return                              identification
 353          */
 354         identification_t* (*get_my_id) (ike_sa_t *this);
 355
 356         /**
 357          * Set the own identification.
 358          *
 359          * @param me                    identification
 360          */
 361         void (*set_my_id) (ike_sa_t *this, identification_t *me);
 362
 363         /**
 364          * Get the other peer's identification.
 365          *
 366          * @return                              identification
 367          */
 368         identification_t* (*get_other_id) (ike_sa_t *this);
 369
 370         /**
 371          * Get the others peer identity, but prefer an EAP-Identity.
 372          *
 373          * @return                              EAP or IKEv2 identity
 374          */
 375         identification_t* (*get_other_eap_id)(ike_sa_t *this);
 376
 377         /**
 378          * Set the other peer's identification.
 379          *
 380          * @param other                 identification
 381          */
 382         void (*set_other_id) (ike_sa_t *this, identification_t *other);
 383
 384         /**
 385          * Get the config used to setup this IKE_SA.
 386          *
 387          * @return                              ike_config
 388          */
 389         ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
 390
 391         /**
 392          * Set the config to setup this IKE_SA.
 393          *
 394          * @param config                ike_config to use
 395          */
 396         void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
 397
 398         /**
 399          * Get the peer config used by this IKE_SA.
 400          *
 401          * @return                              peer_config
 402          */
 403         peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
 404
 405         /**
 406          * Set the peer config to use with this IKE_SA.
 407          *
 408          * @param config                peer_config to use
 409          */
 410         void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
 411
 412         /**
 413          * Get the authentication config with rules of the current auth round.
 414          *
 415          * @param local                 TRUE for local rules, FALSE for remote constraints
 416          * @return                              current cfg
 417          */
 418         auth_cfg_t* (*get_auth_cfg)(ike_sa_t *this, bool local);
 419
 420         /**
 421          * Insert a completed authentication round.
 422          *
 423          * @param local                 TRUE for own rules, FALSE for others constraints
 424          * @param cfg                   auth config to append
 425          */
 426         void (*add_auth_cfg)(ike_sa_t *this, bool local, auth_cfg_t *cfg);
 427
 428         /**
 429          * Create an enumerator over added authentication rounds.
 430          *
 431          * @param local                 TRUE for own rules, FALSE for others constraints
 432          * @return                              enumerator over auth_cfg_t
 433          */
 434         enumerator_t* (*create_auth_cfg_enumerator)(ike_sa_t *this, bool local);
 435
 436         /**
 437          * Get the selected proposal of this IKE_SA.
 438          *
 439          * @return                              selected proposal
 440          */
 441         proposal_t* (*get_proposal)(ike_sa_t *this);
 442
 443         /**
 444          * Set the proposal selected for this IKE_SA.
 445          *
 446          * @param                               selected proposal
 447          */
 448         void (*set_proposal)(ike_sa_t *this, proposal_t *proposal);
 449
 450         /**
 451          * Set the message id of the IKE_SA.
 452          *
 453          * The IKE_SA stores two message IDs, one for initiating exchanges (send)
 454          * and one to respond to exchanges (expect).
 455          *
 456          * @param initiate              TRUE to set message ID for initiating
 457          * @param mid                   message id to set
 458          */
 459         void (*set_message_id)(ike_sa_t *this, bool initiate, u_int32_t mid);
 460
 461         /**
 462          * Add an additional address for the peer.
 463          *
 464          * In MOBIKE, a peer may transmit additional addresses where it is
 465          * reachable. These are stored in the IKE_SA.
 466          * The own list of addresses is not stored, they are queried from
 467          * the kernel when required.
 468          *
 469          * @param host                  host to add to list
 470          */
 471         void (*add_additional_address)(ike_sa_t *this, host_t *host);
 472
 473         /**
 474          * Create an iterator over all additional addresses of the peer.
 475          *
 476          * @return                              iterator over addresses
 477          */
 478         iterator_t* (*create_additional_address_iterator)(ike_sa_t *this);
 479
 480         /**
 481          * Check if mappings have changed on a NAT for our source address.
 482          *
 483          * @param hash                  received DESTINATION_IP hash
 484          * @return                              TRUE if mappings have changed
 485          */
 486         bool (*has_mapping_changed)(ike_sa_t *this, chunk_t hash);
 487
 488         /**
 489          * Enable an extension the peer supports.
 490          *
 491          * If support for an IKE extension is detected, this method is called
 492          * to enable that extension and behave accordingly.
 493          *
 494          * @param extension             extension to enable
 495          */
 496         void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
 497
 498         /**
 499          * Check if the peer supports an extension.
 500          *
 501          * @param extension             extension to check for support
 502          * @return                              TRUE if peer supports it, FALSE otherwise
 503          */
 504         bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
 505
 506         /**
 507          * Enable/disable a condition flag for this IKE_SA.
 508          *
 509          * @param condition             condition to enable/disable
 510          * @param enable                TRUE to enable condition, FALSE to disable
 511          */
 512         void (*set_condition) (ike_sa_t *this, ike_condition_t condition, bool enable);
 513
 514         /**
 515          * Check if a condition flag is set.
 516          *
 517          * @param condition             condition to check
 518          * @return                              TRUE if condition flag set, FALSE otherwise
 519          */
 520         bool (*has_condition) (ike_sa_t *this, ike_condition_t condition);
 521
 522         /**
 523          * Get the number of queued MOBIKE address updates.
 524          *
 525          * @return                              number of pending updates
 526          */
 527         u_int32_t (*get_pending_updates)(ike_sa_t *this);
 528
 529         /**
 530          * Set the number of queued MOBIKE address updates.
 531          *
 532          * @param updates               number of pending updates
 533          */
 534         void (*set_pending_updates)(ike_sa_t *this, u_int32_t updates);
 535
 536 #ifdef ME
 537         /**
 538          * Activate mediation server functionality for this IKE_SA.
 539          */
 540         void (*act_as_mediation_server) (ike_sa_t *this);
 541
 542         /**
 543          * Get the server reflexive host.
 544          *
 545          * @return                              server reflexive host
 546          */
 547         host_t* (*get_server_reflexive_host) (ike_sa_t *this);
 548
 549         /**
 550          * Set the server reflexive host.
 551          *
 552          * @param host                  server reflexive host
 553          */
 554         void (*set_server_reflexive_host) (ike_sa_t *this, host_t *host);
 555
 556         /**
 557          * Get the connect ID.
 558          *
 559          * @return                              connect ID
 560          */
 561         chunk_t (*get_connect_id) (ike_sa_t *this);
 562
 563         /**
 564          * Initiate the mediation of a mediated connection (i.e. initiate a
 565          * ME_CONNECT exchange to a mediation server).
 566          *
 567          * @param mediated_cfg  peer_cfg of the mediated connection
 568          * @return
 569          *                                              - SUCCESS if initialization started
 570          *                                              - DESTROY_ME if initialization failed
 571          */
 572         status_t (*initiate_mediation) (ike_sa_t *this, peer_cfg_t *mediated_cfg);
 573
 574         /**
 575          * Initiate the mediated connection
 576          *
 577          * @param me                    local endpoint (gets cloned)
 578          * @param other                 remote endpoint (gets cloned)
 579          * @param connect_id    connect ID (gets cloned)
 580          * @return
 581          *                                              - SUCCESS if initialization started
 582          *                                              - DESTROY_ME if initialization failed
 583          */
 584         status_t (*initiate_mediated) (ike_sa_t *this, host_t *me, host_t *other,
 585                                                                    chunk_t connect_id);
 586
 587         /**
 588          * Relay data from one peer to another (i.e. initiate a ME_CONNECT exchange
 589          * to a peer).
 590          *
 591          * Data is cloned.
 592          *
 593          * @param requester             ID of the requesting peer
 594          * @param connect_id    data of the ME_CONNECTID payload
 595          * @param connect_key   data of the ME_CONNECTKEY payload
 596          * @param endpoints             endpoints
 597          * @param response              TRUE if this is a response
 598          * @return
 599          *                                              - SUCCESS if relay started
 600          *                                              - DESTROY_ME if relay failed
 601          */
 602         status_t (*relay) (ike_sa_t *this, identification_t *requester,
 603                                            chunk_t connect_id, chunk_t connect_key,
 604                                            linked_list_t *endpoints, bool response);
 605
 606         /**
 607          * Send a callback to a peer.
 608          *
 609          * Data is cloned.
 610          *
 611          * @param peer_id               ID of the other peer
 612          * @return
 613          *                                              - SUCCESS if response started
 614          *                                              - DESTROY_ME if response failed
 615          */
 616         status_t (*callback) (ike_sa_t *this, identification_t *peer_id);
 617
 618         /**
 619          * Respond to a ME_CONNECT request.
 620          *
 621          * Data is cloned.
 622          *
 623          * @param peer_id               ID of the other peer
 624          * @param connect_id    the connect ID supplied by the initiator
 625          * @return
 626          *                                              - SUCCESS if response started
 627          *                                              - DESTROY_ME if response failed
 628          */
 629         status_t (*respond) (ike_sa_t *this, identification_t *peer_id,
 630                                                  chunk_t connect_id);
 631 #endif /* ME */
 632
 633         /**
 634          * Initiate a new connection.
 635          *
 636          * The configs are owned by the IKE_SA after the call. If the initiate
 637          * is triggered by a packet, traffic selectors of the packet can be added
 638          * to the CHILD_SA.
 639          *
 640          * @param child_cfg             child config to create CHILD from
 641          * @param reqid                 reqid to use for CHILD_SA, 0 assigne uniquely
 642          * @param tsi                   source of triggering packet
 643          * @param tsr                   destination of triggering packet.
 644          * @return
 645          *                                              - SUCCESS if initialization started
 646          *                                              - DESTROY_ME if initialization failed
 647          */
 648         status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg,
 649                                                   u_int32_t reqid, traffic_selector_t *tsi,
 650                                                   traffic_selector_t *tsr);
 651
 652         /**
 653          * Initiates the deletion of an IKE_SA.
 654          *
 655          * Sends a delete message to the remote peer and waits for
 656          * its response. If the response comes in, or a timeout occurs,
 657          * the IKE SA gets deleted.
 658          *
 659          * @return
 660          *                                              - SUCCESS if deletion is initialized
 661          *                                              - DESTROY_ME, if the IKE_SA is not in
 662          *                                                an established state and can not be
 663          *                                                deleted (but destroyed).
 664          */
 665         status_t (*delete) (ike_sa_t *this);
 666
 667         /**
 668          * Update IKE_SAs after network interfaces have changed.
 669          *
 670          * Whenever the network interface configuration changes, the kernel
 671          * interface calls roam() on each IKE_SA. The IKE_SA then checks if
 672          * the new network config requires changes, and handles appropriate.
 673          * If MOBIKE is supported, addresses are updated; If not, the tunnel is
 674          * restarted.
 675          *
 676          * @param address               TRUE if address list changed, FALSE otherwise
 677          * @return                              SUCCESS, FAILED, DESTROY_ME
 678          */
 679         status_t (*roam)(ike_sa_t *this, bool address);
 680
 681         /**
 682          * Processes a incoming IKEv2-Message.
 683          *
 684          * Message processing may fail. If a critical failure occurs,
 685          * process_message() return DESTROY_ME. Then the caller must
 686          * destroy the IKE_SA immediatly, as it is unusable.
 687          *
 688          * @param message               message to process
 689          * @return
 690          *                                              - SUCCESS
 691          *                                              - FAILED
 692          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 693          */
 694         status_t (*process_message) (ike_sa_t *this, message_t *message);
 695
 696         /**
 697          * Generate a IKE message to send it to the peer.
 698          *
 699          * This method generates all payloads in the message and encrypts/signs
 700          * the packet.
 701          *
 702          * @param message               message to generate
 703          * @param packet                generated output packet
 704          * @return
 705          *                                              - SUCCESS
 706          *                                              - FAILED
 707          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 708          */
 709         status_t (*generate_message) (ike_sa_t *this, message_t *message,
 710                                                                   packet_t **packet);
 711
 712         /**
 713          * Retransmits a request.
 714          *
 715          * @param message_id    ID of the request to retransmit
 716          * @return
 717          *                                              - SUCCESS
 718          *                                              - NOT_FOUND if request doesn't have to be retransmited
 719          */
 720         status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
 721
 722         /**
 723          * Sends a DPD request to the peer.
 724          *
 725          * To check if a peer is still alive, periodic
 726          * empty INFORMATIONAL messages are sent if no
 727          * other traffic was received.
 728          *
 729          * @return
 730          *                                              - SUCCESS
 731          *                                              - DESTROY_ME, if peer did not respond
 732          */
 733         status_t (*send_dpd) (ike_sa_t *this);
 734
 735         /**
 736          * Sends a keep alive packet.
 737          *
 738          * To refresh NAT tables in a NAT router
 739          * between the peers, periodic empty
 740          * UDP packets are sent if no other traffic
 741          * was sent.
 742          */
 743         void (*send_keepalive) (ike_sa_t *this);
 744
 745         /**
 746          * Get the keying material of this IKE_SA.
 747          *
 748          * @return                              per IKE_SA keymat instance
 749          */
 750         keymat_t* (*get_keymat)(ike_sa_t *this);
 751
 752         /**
 753          * Associates a child SA to this IKE SA
 754          *
 755          * @param child_sa              child_sa to add
 756          */
 757         void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
 758
 759         /**
 760          * Get a CHILD_SA identified by protocol and SPI.
 761          *
 762          * @param protocol              protocol of the SA
 763          * @param spi                   SPI of the CHILD_SA
 764          * @param inbound               TRUE if SPI is inbound, FALSE if outbound
 765          * @return                              child_sa, or NULL if none found
 766          */
 767         child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
 768                                                                  u_int32_t spi, bool inbound);
 769
 770         /**
 771          * Create an iterator over all CHILD_SAs.
 772          *
 773          * @return                              iterator
 774          */
 775         iterator_t* (*create_child_sa_iterator) (ike_sa_t *this);
 776
 777         /**
 778          * Rekey the CHILD SA with the specified reqid.
 779          *
 780          * Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
 781          *
 782          * @param protocol              protocol of the SA
 783          * @param spi                   inbound SPI of the CHILD_SA
 784          * @return
 785          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 786          *                                              - SUCCESS, if rekeying initiated
 787          */
 788         status_t (*rekey_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 789
 790         /**
 791          * Close the CHILD SA with the specified protocol/SPI.
 792          *
 793          * Looks for a CHILD SA owned by this IKE_SA, deletes it and
 794          * notify's the remote peer about the delete. The associated
 795          * states and policies in the kernel get deleted, if they exist.
 796          *
 797          * @param protocol              protocol of the SA
 798          * @param spi                   inbound SPI of the CHILD_SA
 799          * @return
 800          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 801          *                                              - SUCCESS, if delete message sent
 802          */
 803         status_t (*delete_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 804
 805         /**
 806          * Destroy a CHILD SA with the specified protocol/SPI.
 807          *
 808          * Looks for a CHILD SA owned by this IKE_SA and destroys it.
 809          *
 810          * @param protocol              protocol of the SA
 811          * @param spi                   inbound SPI of the CHILD_SA
 812          * @return
 813          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 814          *                                              - SUCCESS
 815          */
 816         status_t (*destroy_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 817
 818         /**
 819          * Rekey the IKE_SA.
 820          *
 821          * Sets up a new IKE_SA, moves all CHILDs to it and deletes this IKE_SA.
 822          *
 823          * @return                              - SUCCESS, if IKE_SA rekeying initiated
 824          */
 825         status_t (*rekey) (ike_sa_t *this);
 826
 827         /**
 828          * Reauthenticate the IKE_SA.
 829          *
 830          * Create a completely new IKE_SA with authentication, recreates all children
 831          * within the IKE_SA, closes this IKE_SA.
 832          *
 833          * @return                              DESTROY_ME to destroy the IKE_SA
 834          */
 835         status_t (*reauth) (ike_sa_t *this);
 836
 837         /**
 838          * Restablish the IKE_SA.
 839          *
 840          * Reestablish an IKE_SA after it has been closed.
 841          *
 842          * @return                              DESTROY_ME to destroy the IKE_SA
 843          */
 844         status_t (*reestablish) (ike_sa_t *this);
 845
 846         /**
 847          * Set the lifetime limit received from a AUTH_LIFETIME notify.
 848          *
 849          * @param lifetime              lifetime in seconds
 850          */
 851         void (*set_auth_lifetime)(ike_sa_t *this, u_int32_t lifetime);
 852
 853         /**
 854          * Set the virtual IP to use for this IKE_SA and its children.
 855          *
 856          * The virtual IP is assigned per IKE_SA, not per CHILD_SA. It has the same
 857          * lifetime as the IKE_SA.
 858          *
 859          * @param local                 TRUE to set local address, FALSE for remote
 860          * @param ip                    IP to set as virtual IP
 861          */
 862         void (*set_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
 863
 864         /**
 865          * Get the virtual IP configured.
 866          *
 867          * @param local                 TRUE to get local virtual IP, FALSE for remote
 868          * @return                              host_t *virtual IP
 869          */
 870         host_t* (*get_virtual_ip) (ike_sa_t *this, bool local);
 871
 872         /**
 873          * Register a configuration attribute to the IKE_SA.
 874          *
 875          * If an IRAS sends a configuration attribute it is installed and
 876          * registered at the IKE_SA. Attributes are inherit()ed and get released
 877          * when the IKE_SA is closed.
 878          *
 879          * @param handler               handler installed the attribute, use for release()
 880          * @param type                  configuration attribute type
 881          * @param data                  associated attribute data
 882          */
 883         void (*add_configuration_attribute)(ike_sa_t *this,
 884                                                         attribute_handler_t *handler,
 885                                                         configuration_attribute_type_t type, chunk_t data);
 886
 887         /**
 888          * Set local and remote host addresses to be used for IKE.
 889          *
 890          * These addresses are communicated via the KMADDRESS field of a MIGRATE
 891          * message sent via the NETLINK or PF _KEY kernel socket interface.
 892          *
 893          * @param local                 local kmaddress
 894          * @param remote                remote kmaddress
 895          */
 896         void (*set_kmaddress) (ike_sa_t *this, host_t *local, host_t *remote);
 897
 898         /**
 899          * Create enumerator over a task queue of this IKE_SA.
 900          *
 901          * @param                               queue type to enumerate
 902          * @return                              enumerator over task_t
 903          */
 904         enumerator_t* (*create_task_enumerator)(ike_sa_t *this, task_queue_t queue);
 905
 906         /**
 907          * Inherit all attributes of other to this after rekeying.
 908          *
 909          * When rekeying is completed, all CHILD_SAs, the virtual IP and all
 910          * outstanding tasks are moved from other to this.
 911          * As this call may initiate inherited tasks, a status is returned.
 912          *
 913          * @param other                 other task to inherit from
 914          * @return                              DESTROY_ME if initiation of inherited task failed
 915          */
 916         status_t (*inherit) (ike_sa_t *this, ike_sa_t *other);
 917
 918         /**
 919          * Reset the IKE_SA, useable when initiating fails
 920          */
 921         void (*reset) (ike_sa_t *this);
 922
 923         /**
 924          * Destroys a ike_sa_t object.
 925          */
 926         void (*destroy) (ike_sa_t *this);
 927 };
 928
 929 /**
 930  * Creates an ike_sa_t object with a specific ID.
 931  *
 932  * @param ike_sa_id     ike_sa_id_t object to associate with new IKE_SA
 933  * @return                              ike_sa_t object
 934  */
 935 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id);
 936
 937 #endif /** IKE_SA_H_ @}*/