src/libcharon/sa/ike_sa.h

   1 /*
   2  * Copyright (C) 2006-2012 Tobias Brunner
   3  * Copyright (C) 2006 Daniel Roethlisberger
   4  * Copyright (C) 2005-2009 Martin Willi
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 /**
  20  * @defgroup ike_sa ike_sa
  21  * @{ @ingroup sa
  22  */
  23
  24 #ifndef IKE_SA_H_
  25 #define IKE_SA_H_
  26
  27 typedef enum ike_extension_t ike_extension_t;
  28 typedef enum ike_condition_t ike_condition_t;
  29 typedef enum ike_sa_state_t ike_sa_state_t;
  30 typedef enum statistic_t statistic_t;
  31 typedef struct ike_sa_t ike_sa_t;
  32
  33 #include <library.h>
  34 #include <attributes/attribute_handler.h>
  35 #include <encoding/message.h>
  36 #include <encoding/payloads/proposal_substructure.h>
  37 #include <encoding/payloads/configuration_attribute.h>
  38 #include <sa/ike_sa_id.h>
  39 #include <sa/child_sa.h>
  40 #include <sa/task.h>
  41 #include <sa/task_manager.h>
  42 #include <sa/keymat.h>
  43 #include <config/peer_cfg.h>
  44 #include <config/ike_cfg.h>
  45 #include <credentials/auth_cfg.h>
  46 #include <networking/packet.h>
  47
  48 /**
  49  * Timeout in seconds after that a half open IKE_SA gets deleted.
  50  */
  51 #define HALF_OPEN_IKE_SA_TIMEOUT 30
  52
  53 /**
  54  * Interval to send keepalives when NATed, in seconds.
  55  */
  56 #define KEEPALIVE_INTERVAL 20
  57
  58 /**
  59  * After which time rekeying should be retried if it failed, in seconds.
  60  */
  61 #define RETRY_INTERVAL 30
  62
  63 /**
  64  * Jitter to subtract from RETRY_INTERVAL to randomize rekey retry.
  65  */
  66 #define RETRY_JITTER 20
  67
  68 /**
  69  * Extensions (or optional features) the peer supports
  70  */
  71 enum ike_extension_t {
  72
  73         /**
  74          * peer supports NAT traversal as specified in RFC4306 or RFC3947
  75          * including some RFC3947 drafts
  76          */
  77         EXT_NATT = (1<<0),
  78
  79         /**
  80          * peer supports MOBIKE (RFC4555)
  81          */
  82         EXT_MOBIKE = (1<<1),
  83
  84         /**
  85          * peer supports HTTP cert lookups as specified in RFC4306
  86          */
  87         EXT_HASH_AND_URL = (1<<2),
  88
  89         /**
  90          * peer supports multiple authentication exchanges, RFC4739
  91          */
  92         EXT_MULTIPLE_AUTH = (1<<3),
  93
  94         /**
  95          * peer uses strongSwan, accept private use extensions
  96          */
  97         EXT_STRONGSWAN = (1<<4),
  98
  99         /**
 100          * peer supports EAP-only authentication, draft-eronen-ipsec-ikev2-eap-auth
 101          */
 102         EXT_EAP_ONLY_AUTHENTICATION = (1<<5),
 103
 104         /**
 105          * peer is probably a Windows 7 RAS client
 106          */
 107         EXT_MS_WINDOWS = (1<<6),
 108
 109         /**
 110          * peer supports XAuth authentication, draft-ietf-ipsec-isakmp-xauth-06
 111          */
 112         EXT_XAUTH = (1<<7),
 113
 114         /**
 115          * peer supports DPD detection, RFC 3706 (or IKEv2)
 116          */
 117         EXT_DPD = (1<<8),
 118
 119         /**
 120          * peer supports Cisco Unity configuration attributes
 121          */
 122         EXT_CISCO_UNITY = (1<<9),
 123
 124         /**
 125          * peer supports NAT traversal as specified in
 126          * draft-ietf-ipsec-nat-t-ike-02 .. -03
 127          */
 128         EXT_NATT_DRAFT_02_03 = (1<<10),
 129
 130         /**
 131          * peer support proprietary IKE fragmentation
 132          */
 133         EXT_IKE_FRAGMENTATION = (1<<11),
 134 };
 135
 136 /**
 137  * Conditions of an IKE_SA, change during its lifetime
 138  */
 139 enum ike_condition_t {
 140
 141         /**
 142          * Connection is natted (or faked) somewhere
 143          */
 144         COND_NAT_ANY = (1<<0),
 145
 146         /**
 147          * we are behind NAT
 148          */
 149         COND_NAT_HERE = (1<<1),
 150
 151         /**
 152          * other is behind NAT
 153          */
 154         COND_NAT_THERE = (1<<2),
 155
 156         /**
 157          * Faking NAT to enforce UDP encapsulation
 158          */
 159         COND_NAT_FAKE = (1<<3),
 160
 161         /**
 162          * peer has been authenticated using EAP at least once
 163          */
 164         COND_EAP_AUTHENTICATED = (1<<4),
 165
 166         /**
 167          * received a certificate request from the peer
 168          */
 169         COND_CERTREQ_SEEN = (1<<5),
 170
 171         /**
 172          * Local peer is the "original" IKE initiator. Unaffected from rekeying.
 173          */
 174         COND_ORIGINAL_INITIATOR = (1<<6),
 175
 176         /**
 177          * IKE_SA is stale, the peer is currently unreachable (MOBIKE)
 178          */
 179         COND_STALE = (1<<7),
 180
 181         /**
 182          * Initial contact received
 183          */
 184         COND_INIT_CONTACT_SEEN = (1<<8),
 185
 186         /**
 187          * Peer has been authenticated using XAuth
 188          */
 189         COND_XAUTH_AUTHENTICATED = (1<<9),
 190
 191         /**
 192          * This IKE_SA is currently being reauthenticated
 193          */
 194         COND_REAUTHENTICATING = (1<<10),
 195 };
 196
 197 /**
 198  * Timing information and statistics to query from an SA
 199  */
 200 enum statistic_t {
 201         /** Timestamp of SA establishement */
 202         STAT_ESTABLISHED = 0,
 203         /** Timestamp of scheudled rekeying */
 204         STAT_REKEY,
 205         /** Timestamp of scheudled reauthentication */
 206         STAT_REAUTH,
 207         /** Timestamp of scheudled delete */
 208         STAT_DELETE,
 209         /** Timestamp of last inbound IKE packet */
 210         STAT_INBOUND,
 211         /** Timestamp of last outbound IKE packet */
 212         STAT_OUTBOUND,
 213
 214         STAT_MAX
 215 };
 216
 217 /**
 218  * State of an IKE_SA.
 219  *
 220  * An IKE_SA passes various states in its lifetime. A newly created
 221  * SA is in the state CREATED.
 222  * @verbatim
 223                  +----------------+
 224                  ¦   SA_CREATED   ¦
 225                  +----------------+
 226                          ¦
 227     on initiate()--->    ¦   <----- on IKE_SA_INIT received
 228                          V
 229                  +----------------+
 230                  ¦ SA_CONNECTING  ¦
 231                  +----------------+
 232                          ¦
 233                          ¦   <----- on IKE_AUTH successfully completed
 234                          V
 235                  +----------------+
 236                  ¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
 237                  +----------------+                         ¦
 238                          ¦                                  V
 239     on delete()--->      ¦   <----- on IKE_SA        +-------------+
 240                          ¦          delete request   ¦ SA_REKEYING ¦
 241                          ¦          received         +-------------+
 242                          V                                  ¦
 243                  +----------------+                         ¦
 244                  ¦  SA_DELETING   ¦<------------------------+ <-- after rekeying
 245                  +----------------+
 246                          ¦
 247                          ¦   <----- after delete() acknowledged
 248                          ¦
 249                         \V/
 250                          X
 251                         / \
 252    @endverbatim
 253  */
 254 enum ike_sa_state_t {
 255
 256         /**
 257          * IKE_SA just got created, but is not initiating nor responding yet.
 258          */
 259         IKE_CREATED,
 260
 261         /**
 262          * IKE_SA gets initiated actively or passively
 263          */
 264         IKE_CONNECTING,
 265
 266         /**
 267          * IKE_SA is fully established
 268          */
 269         IKE_ESTABLISHED,
 270
 271         /**
 272          * IKE_SA is managed externally and does not process messages
 273          */
 274         IKE_PASSIVE,
 275
 276         /**
 277          * IKE_SA rekeying in progress
 278          */
 279         IKE_REKEYING,
 280
 281         /**
 282          * IKE_SA is in progress of deletion
 283          */
 284         IKE_DELETING,
 285
 286         /**
 287          * IKE_SA object gets destroyed
 288          */
 289         IKE_DESTROYING,
 290 };
 291
 292 /**
 293  * enum names for ike_sa_state_t.
 294  */
 295 extern enum_name_t *ike_sa_state_names;
 296
 297 /**
 298  * Class ike_sa_t representing an IKE_SA.
 299  *
 300  * An IKE_SA contains crypto information related to a connection
 301  * with a peer. It contains multiple IPsec CHILD_SA, for which
 302  * it is responsible. All traffic is handled by an IKE_SA, using
 303  * the task manager and its tasks.
 304  */
 305 struct ike_sa_t {
 306
 307         /**
 308          * Get the id of the SA.
 309          *
 310          * Returned ike_sa_id_t object is not getting cloned!
 311          *
 312          * @return                              ike_sa's ike_sa_id_t
 313          */
 314         ike_sa_id_t* (*get_id) (ike_sa_t *this);
 315
 316         /**
 317          * Gets the IKE version of the SA
 318          */
 319         ike_version_t (*get_version)(ike_sa_t *this);
 320
 321         /**
 322          * Get the numerical ID uniquely defining this IKE_SA.
 323          *
 324          * @return                              unique ID
 325          */
 326         u_int32_t (*get_unique_id) (ike_sa_t *this);
 327
 328         /**
 329          * Get the state of the IKE_SA.
 330          *
 331          * @return                              state of the IKE_SA
 332          */
 333         ike_sa_state_t (*get_state) (ike_sa_t *this);
 334
 335         /**
 336          * Set the state of the IKE_SA.
 337          *
 338          * @param state                 state to set for the IKE_SA
 339          */
 340         void (*set_state) (ike_sa_t *this, ike_sa_state_t state);
 341
 342         /**
 343          * Get the name of the connection this IKE_SA uses.
 344          *
 345          * @return                              name
 346          */
 347         char* (*get_name) (ike_sa_t *this);
 348
 349         /**
 350          * Get statistic values from the IKE_SA.
 351          *
 352          * @param kind                  kind of requested value
 353          * @return                              value as integer
 354          */
 355         u_int32_t (*get_statistic)(ike_sa_t *this, statistic_t kind);
 356
 357         /**
 358          * Set statistic value of the IKE_SA.
 359          *
 360          * @param kind                  kind of value to update
 361          * @param value                 value as integer
 362          */
 363         void (*set_statistic)(ike_sa_t *this, statistic_t kind, u_int32_t value);
 364
 365         /**
 366          * Get the own host address.
 367          *
 368          * @return                              host address
 369          */
 370         host_t* (*get_my_host) (ike_sa_t *this);
 371
 372         /**
 373          * Set the own host address.
 374          *
 375          * @param me                    host address
 376          */
 377         void (*set_my_host) (ike_sa_t *this, host_t *me);
 378
 379         /**
 380          * Get the other peers host address.
 381          *
 382          * @return                              host address
 383          */
 384         host_t* (*get_other_host) (ike_sa_t *this);
 385
 386         /**
 387          * Set the others host address.
 388          *
 389          * @param other                 host address
 390          */
 391         void (*set_other_host) (ike_sa_t *this, host_t *other);
 392
 393         /**
 394          * Float to port 4500 (e.g. if a NAT is detected).
 395          *
 396          * The port of either endpoint is changed only if it is currently
 397          * set to the default value of 500.
 398          */
 399         void (*float_ports)(ike_sa_t *this);
 400
 401         /**
 402          * Update the IKE_SAs host.
 403          *
 404          * Hosts may be NULL to use current host.
 405          *
 406          * @param me                    new local host address, or NULL
 407          * @param other                 new remote host address, or NULL
 408          * @param force                 force update
 409          */
 410         void (*update_hosts)(ike_sa_t *this, host_t *me, host_t *other, bool force);
 411
 412         /**
 413          * Get the own identification.
 414          *
 415          * @return                              identification
 416          */
 417         identification_t* (*get_my_id) (ike_sa_t *this);
 418
 419         /**
 420          * Set the own identification.
 421          *
 422          * @param me                    identification
 423          */
 424         void (*set_my_id) (ike_sa_t *this, identification_t *me);
 425
 426         /**
 427          * Get the other peer's identification.
 428          *
 429          * @return                              identification
 430          */
 431         identification_t* (*get_other_id) (ike_sa_t *this);
 432
 433         /**
 434          * Get the others peer identity, but prefer an EAP-Identity.
 435          *
 436          * @return                              EAP or IKEv2 identity
 437          */
 438         identification_t* (*get_other_eap_id)(ike_sa_t *this);
 439
 440         /**
 441          * Set the other peer's identification.
 442          *
 443          * @param other                 identification
 444          */
 445         void (*set_other_id) (ike_sa_t *this, identification_t *other);
 446
 447         /**
 448          * Get the config used to setup this IKE_SA.
 449          *
 450          * @return                              ike_config
 451          */
 452         ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
 453
 454         /**
 455          * Set the config to setup this IKE_SA.
 456          *
 457          * @param config                ike_config to use
 458          */
 459         void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
 460
 461         /**
 462          * Get the peer config used by this IKE_SA.
 463          *
 464          * @return                              peer_config
 465          */
 466         peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
 467
 468         /**
 469          * Set the peer config to use with this IKE_SA.
 470          *
 471          * @param config                peer_config to use
 472          */
 473         void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
 474
 475         /**
 476          * Get the authentication config with rules of the current auth round.
 477          *
 478          * @param local                 TRUE for local rules, FALSE for remote constraints
 479          * @return                              current cfg
 480          */
 481         auth_cfg_t* (*get_auth_cfg)(ike_sa_t *this, bool local);
 482
 483         /**
 484          * Insert a completed authentication round.
 485          *
 486          * @param local                 TRUE for own rules, FALSE for others constraints
 487          * @param cfg                   auth config to append
 488          */
 489         void (*add_auth_cfg)(ike_sa_t *this, bool local, auth_cfg_t *cfg);
 490
 491         /**
 492          * Create an enumerator over added authentication rounds.
 493          *
 494          * @param local                 TRUE for own rules, FALSE for others constraints
 495          * @return                              enumerator over auth_cfg_t
 496          */
 497         enumerator_t* (*create_auth_cfg_enumerator)(ike_sa_t *this, bool local);
 498
 499         /**
 500          * Get the selected proposal of this IKE_SA.
 501          *
 502          * @return                              selected proposal
 503          */
 504         proposal_t* (*get_proposal)(ike_sa_t *this);
 505
 506         /**
 507          * Set the proposal selected for this IKE_SA.
 508          *
 509          * @param                               selected proposal
 510          */
 511         void (*set_proposal)(ike_sa_t *this, proposal_t *proposal);
 512
 513         /**
 514          * Set the message id of the IKE_SA.
 515          *
 516          * The IKE_SA stores two message IDs, one for initiating exchanges (send)
 517          * and one to respond to exchanges (expect).
 518          *
 519          * @param initiate              TRUE to set message ID for initiating
 520          * @param mid                   message id to set
 521          */
 522         void (*set_message_id)(ike_sa_t *this, bool initiate, u_int32_t mid);
 523
 524         /**
 525          * Add an additional address for the peer.
 526          *
 527          * In MOBIKE, a peer may transmit additional addresses where it is
 528          * reachable. These are stored in the IKE_SA.
 529          * The own list of addresses is not stored, they are queried from
 530          * the kernel when required.
 531          *
 532          * @param host                  host to add to list
 533          */
 534         void (*add_peer_address)(ike_sa_t *this, host_t *host);
 535
 536         /**
 537          * Create an enumerator over all known addresses of the peer.
 538          *
 539          * @return                              enumerator over addresses
 540          */
 541         enumerator_t* (*create_peer_address_enumerator)(ike_sa_t *this);
 542
 543         /**
 544          * Remove all known addresses of the peer.
 545          */
 546         void (*clear_peer_addresses)(ike_sa_t *this);
 547
 548         /**
 549          * Check if mappings have changed on a NAT for our source address.
 550          *
 551          * @param hash                  received DESTINATION_IP hash
 552          * @return                              TRUE if mappings have changed
 553          */
 554         bool (*has_mapping_changed)(ike_sa_t *this, chunk_t hash);
 555
 556         /**
 557          * Enable an extension the peer supports.
 558          *
 559          * If support for an IKE extension is detected, this method is called
 560          * to enable that extension and behave accordingly.
 561          *
 562          * @param extension             extension to enable
 563          */
 564         void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
 565
 566         /**
 567          * Check if the peer supports an extension.
 568          *
 569          * @param extension             extension to check for support
 570          * @return                              TRUE if peer supports it, FALSE otherwise
 571          */
 572         bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
 573
 574         /**
 575          * Enable/disable a condition flag for this IKE_SA.
 576          *
 577          * @param condition             condition to enable/disable
 578          * @param enable                TRUE to enable condition, FALSE to disable
 579          */
 580         void (*set_condition) (ike_sa_t *this, ike_condition_t condition, bool enable);
 581
 582         /**
 583          * Check if a condition flag is set.
 584          *
 585          * @param condition             condition to check
 586          * @return                              TRUE if condition flag set, FALSE otherwise
 587          */
 588         bool (*has_condition) (ike_sa_t *this, ike_condition_t condition);
 589
 590         /**
 591          * Get the number of queued MOBIKE address updates.
 592          *
 593          * @return                              number of pending updates
 594          */
 595         u_int32_t (*get_pending_updates)(ike_sa_t *this);
 596
 597         /**
 598          * Set the number of queued MOBIKE address updates.
 599          *
 600          * @param updates               number of pending updates
 601          */
 602         void (*set_pending_updates)(ike_sa_t *this, u_int32_t updates);
 603
 604 #ifdef ME
 605         /**
 606          * Activate mediation server functionality for this IKE_SA.
 607          */
 608         void (*act_as_mediation_server) (ike_sa_t *this);
 609
 610         /**
 611          * Get the server reflexive host.
 612          *
 613          * @return                              server reflexive host
 614          */
 615         host_t* (*get_server_reflexive_host) (ike_sa_t *this);
 616
 617         /**
 618          * Set the server reflexive host.
 619          *
 620          * @param host                  server reflexive host
 621          */
 622         void (*set_server_reflexive_host) (ike_sa_t *this, host_t *host);
 623
 624         /**
 625          * Get the connect ID.
 626          *
 627          * @return                              connect ID
 628          */
 629         chunk_t (*get_connect_id) (ike_sa_t *this);
 630
 631         /**
 632          * Initiate the mediation of a mediated connection (i.e. initiate a
 633          * ME_CONNECT exchange to a mediation server).
 634          *
 635          * @param mediated_cfg  peer_cfg of the mediated connection
 636          * @return
 637          *                                              - SUCCESS if initialization started
 638          *                                              - DESTROY_ME if initialization failed
 639          */
 640         status_t (*initiate_mediation) (ike_sa_t *this, peer_cfg_t *mediated_cfg);
 641
 642         /**
 643          * Initiate the mediated connection
 644          *
 645          * @param me                    local endpoint (gets cloned)
 646          * @param other                 remote endpoint (gets cloned)
 647          * @param connect_id    connect ID (gets cloned)
 648          * @return
 649          *                                              - SUCCESS if initialization started
 650          *                                              - DESTROY_ME if initialization failed
 651          */
 652         status_t (*initiate_mediated) (ike_sa_t *this, host_t *me, host_t *other,
 653                                                                    chunk_t connect_id);
 654
 655         /**
 656          * Relay data from one peer to another (i.e. initiate a ME_CONNECT exchange
 657          * to a peer).
 658          *
 659          * Data is cloned.
 660          *
 661          * @param requester             ID of the requesting peer
 662          * @param connect_id    data of the ME_CONNECTID payload
 663          * @param connect_key   data of the ME_CONNECTKEY payload
 664          * @param endpoints             endpoints
 665          * @param response              TRUE if this is a response
 666          * @return
 667          *                                              - SUCCESS if relay started
 668          *                                              - DESTROY_ME if relay failed
 669          */
 670         status_t (*relay) (ike_sa_t *this, identification_t *requester,
 671                                            chunk_t connect_id, chunk_t connect_key,
 672                                            linked_list_t *endpoints, bool response);
 673
 674         /**
 675          * Send a callback to a peer.
 676          *
 677          * Data is cloned.
 678          *
 679          * @param peer_id               ID of the other peer
 680          * @return
 681          *                                              - SUCCESS if response started
 682          *                                              - DESTROY_ME if response failed
 683          */
 684         status_t (*callback) (ike_sa_t *this, identification_t *peer_id);
 685
 686         /**
 687          * Respond to a ME_CONNECT request.
 688          *
 689          * Data is cloned.
 690          *
 691          * @param peer_id               ID of the other peer
 692          * @param connect_id    the connect ID supplied by the initiator
 693          * @return
 694          *                                              - SUCCESS if response started
 695          *                                              - DESTROY_ME if response failed
 696          */
 697         status_t (*respond) (ike_sa_t *this, identification_t *peer_id,
 698                                                  chunk_t connect_id);
 699 #endif /* ME */
 700
 701         /**
 702          * Initiate a new connection.
 703          *
 704          * The configs are owned by the IKE_SA after the call. If the initiate
 705          * is triggered by a packet, traffic selectors of the packet can be added
 706          * to the CHILD_SA.
 707          *
 708          * @param child_cfg             child config to create CHILD from
 709          * @param reqid                 reqid to use for CHILD_SA, 0 assigne uniquely
 710          * @param tsi                   source of triggering packet
 711          * @param tsr                   destination of triggering packet.
 712          * @return
 713          *                                              - SUCCESS if initialization started
 714          *                                              - DESTROY_ME if initialization failed
 715          */
 716         status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg,
 717                                                   u_int32_t reqid, traffic_selector_t *tsi,
 718                                                   traffic_selector_t *tsr);
 719
 720         /**
 721          * Retry initiation of this IKE_SA after it got deferred previously.
 722          *
 723          * @return
 724          *                                              - SUCCESS if initiation deferred or started
 725          *                                              - DESTROY_ME if initiation failed
 726          */
 727         status_t (*retry_initiate) (ike_sa_t *this);
 728
 729         /**
 730          * Initiates the deletion of an IKE_SA.
 731          *
 732          * Sends a delete message to the remote peer and waits for
 733          * its response. If the response comes in, or a timeout occurs,
 734          * the IKE SA gets deleted.
 735          *
 736          * @return
 737          *                                              - SUCCESS if deletion is initialized
 738          *                                              - DESTROY_ME, if the IKE_SA is not in
 739          *                                                an established state and can not be
 740          *                                                deleted (but destroyed).
 741          */
 742         status_t (*delete) (ike_sa_t *this);
 743
 744         /**
 745          * Update IKE_SAs after network interfaces have changed.
 746          *
 747          * Whenever the network interface configuration changes, the kernel
 748          * interface calls roam() on each IKE_SA. The IKE_SA then checks if
 749          * the new network config requires changes, and handles appropriate.
 750          * If MOBIKE is supported, addresses are updated; If not, the tunnel is
 751          * restarted.
 752          *
 753          * @param address               TRUE if address list changed, FALSE otherwise
 754          * @return                              SUCCESS, FAILED, DESTROY_ME
 755          */
 756         status_t (*roam)(ike_sa_t *this, bool address);
 757
 758         /**
 759          * Processes a incoming IKEv2-Message.
 760          *
 761          * Message processing may fail. If a critical failure occurs,
 762          * process_message() return DESTROY_ME. Then the caller must
 763          * destroy the IKE_SA immediately, as it is unusable.
 764          *
 765          * @param message               message to process
 766          * @return
 767          *                                              - SUCCESS
 768          *                                              - FAILED
 769          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 770          */
 771         status_t (*process_message) (ike_sa_t *this, message_t *message);
 772
 773         /**
 774          * Generate a IKE message to send it to the peer.
 775          *
 776          * This method generates all payloads in the message and encrypts/signs
 777          * the packet.
 778          *
 779          * @param message               message to generate
 780          * @param packet                generated output packet
 781          * @return
 782          *                                              - SUCCESS
 783          *                                              - FAILED
 784          *                                              - DESTROY_ME if this IKE_SA MUST be deleted
 785          */
 786         status_t (*generate_message) (ike_sa_t *this, message_t *message,
 787                                                                   packet_t **packet);
 788
 789         /**
 790          * Retransmits a request.
 791          *
 792          * @param message_id    ID of the request to retransmit
 793          * @return
 794          *                                              - SUCCESS
 795          *                                              - NOT_FOUND if request doesn't have to be retransmited
 796          */
 797         status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
 798
 799         /**
 800          * Sends a DPD request to the peer.
 801          *
 802          * To check if a peer is still alive, periodic
 803          * empty INFORMATIONAL messages are sent if no
 804          * other traffic was received.
 805          *
 806          * @return
 807          *                                              - SUCCESS
 808          *                                              - DESTROY_ME, if peer did not respond
 809          */
 810         status_t (*send_dpd) (ike_sa_t *this);
 811
 812         /**
 813          * Sends a keep alive packet.
 814          *
 815          * To refresh NAT tables in a NAT router
 816          * between the peers, periodic empty
 817          * UDP packets are sent if no other traffic
 818          * was sent.
 819          */
 820         void (*send_keepalive) (ike_sa_t *this);
 821
 822         /**
 823          * Get the keying material of this IKE_SA.
 824          *
 825          * @return                              per IKE_SA keymat instance
 826          */
 827         keymat_t* (*get_keymat)(ike_sa_t *this);
 828
 829         /**
 830          * Associates a child SA to this IKE SA
 831          *
 832          * @param child_sa              child_sa to add
 833          */
 834         void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
 835
 836         /**
 837          * Get a CHILD_SA identified by protocol and SPI.
 838          *
 839          * @param protocol              protocol of the SA
 840          * @param spi                   SPI of the CHILD_SA
 841          * @param inbound               TRUE if SPI is inbound, FALSE if outbound
 842          * @return                              child_sa, or NULL if none found
 843          */
 844         child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
 845                                                                  u_int32_t spi, bool inbound);
 846
 847         /**
 848          * Get the number of CHILD_SAs.
 849          *
 850          * @return                              number of CHILD_SAs
 851          */
 852         int (*get_child_count) (ike_sa_t *this);
 853
 854         /**
 855          * Create an enumerator over all CHILD_SAs.
 856          *
 857          * @return                              enumerator
 858          */
 859         enumerator_t* (*create_child_sa_enumerator) (ike_sa_t *this);
 860
 861         /**
 862          * Remove the CHILD_SA the given enumerator points to from this IKE_SA.
 863          *
 864          * @param enumerator    enumerator pointing to CHILD_SA
 865          */
 866         void (*remove_child_sa) (ike_sa_t *this, enumerator_t *enumerator);
 867
 868         /**
 869          * Rekey the CHILD SA with the specified reqid.
 870          *
 871          * Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
 872          *
 873          * @param protocol              protocol of the SA
 874          * @param spi                   inbound SPI of the CHILD_SA
 875          * @return
 876          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 877          *                                              - SUCCESS, if rekeying initiated
 878          */
 879         status_t (*rekey_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 880
 881         /**
 882          * Close the CHILD SA with the specified protocol/SPI.
 883          *
 884          * Looks for a CHILD SA owned by this IKE_SA, deletes it and
 885          * notify's the remote peer about the delete. The associated
 886          * states and policies in the kernel get deleted, if they exist.
 887          *
 888          * @param protocol              protocol of the SA
 889          * @param spi                   inbound SPI of the CHILD_SA
 890          * @param expired               TRUE if CHILD_SA is expired
 891          * @return
 892          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 893          *                                              - SUCCESS, if delete message sent
 894          */
 895         status_t (*delete_child_sa)(ike_sa_t *this, protocol_id_t protocol,
 896                                                                 u_int32_t spi, bool expired);
 897
 898         /**
 899          * Destroy a CHILD SA with the specified protocol/SPI.
 900          *
 901          * Looks for a CHILD SA owned by this IKE_SA and destroys it.
 902          *
 903          * @param protocol              protocol of the SA
 904          * @param spi                   inbound SPI of the CHILD_SA
 905          * @return
 906          *                                              - NOT_FOUND, if IKE_SA has no such CHILD_SA
 907          *                                              - SUCCESS
 908          */
 909         status_t (*destroy_child_sa) (ike_sa_t *this, protocol_id_t protocol, u_int32_t spi);
 910
 911         /**
 912          * Rekey the IKE_SA.
 913          *
 914          * Sets up a new IKE_SA, moves all CHILDs to it and deletes this IKE_SA.
 915          *
 916          * @return                              - SUCCESS, if IKE_SA rekeying initiated
 917          */
 918         status_t (*rekey) (ike_sa_t *this);
 919
 920         /**
 921          * Reauthenticate the IKE_SA.
 922          *
 923          * Create a completely new IKE_SA with authentication, recreates all children
 924          * within the IKE_SA, closes this IKE_SA.
 925          *
 926          * @return                              DESTROY_ME to destroy the IKE_SA
 927          */
 928         status_t (*reauth) (ike_sa_t *this);
 929
 930         /**
 931          * Restablish the IKE_SA.
 932          *
 933          * Reestablish an IKE_SA after it has been closed.
 934          *
 935          * @return                              DESTROY_ME to destroy the IKE_SA
 936          */
 937         status_t (*reestablish) (ike_sa_t *this);
 938
 939         /**
 940          * Set the lifetime limit received/to send in a AUTH_LIFETIME notify.
 941          *
 942          * If the IKE_SA is already ESTABLISHED, an INFORMATIONAL is sent with
 943          * an AUTH_LIFETIME notify. The call never fails on unestablished SAs.
 944          *
 945          * @param lifetime              lifetime in seconds
 946          * @return                              DESTROY_ME to destroy the IKE_SA
 947          */
 948         status_t (*set_auth_lifetime)(ike_sa_t *this, u_int32_t lifetime);
 949
 950         /**
 951          * Add a virtual IP to use for this IKE_SA and its children.
 952          *
 953          * The virtual IP is assigned per IKE_SA, not per CHILD_SA. It has the same
 954          * lifetime as the IKE_SA.
 955          *
 956          * @param local                 TRUE to set local address, FALSE for remote
 957          * @param ip                    IP to set as virtual IP
 958          */
 959         void (*add_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
 960
 961         /**
 962          * Clear all virtual IPs stored on this IKE_SA.
 963          *
 964          * @param local                 TRUE to clear local addresses, FALSE for remote
 965          */
 966         void (*clear_virtual_ips) (ike_sa_t *this, bool local);
 967
 968         /**
 969          * Create an enumerator over virtual IPs.
 970          *
 971          * @param local                 TRUE to get local virtual IP, FALSE for remote
 972          * @return                              enumerator over host_t*
 973          */
 974         enumerator_t* (*create_virtual_ip_enumerator) (ike_sa_t *this, bool local);
 975
 976         /**
 977          * Register a configuration attribute to the IKE_SA.
 978          *
 979          * If an IRAS sends a configuration attribute it is installed and
 980          * registered at the IKE_SA. Attributes are inherit()ed and get released
 981          * when the IKE_SA is closed.
 982          *
 983          * @param handler               handler installed the attribute, use for release()
 984          * @param type                  configuration attribute type
 985          * @param data                  associated attribute data
 986          */
 987         void (*add_configuration_attribute)(ike_sa_t *this,
 988                                                         attribute_handler_t *handler,
 989                                                         configuration_attribute_type_t type, chunk_t data);
 990
 991         /**
 992          * Set local and remote host addresses to be used for IKE.
 993          *
 994          * These addresses are communicated via the KMADDRESS field of a MIGRATE
 995          * message sent via the NETLINK or PF _KEY kernel socket interface.
 996          *
 997          * @param local                 local kmaddress
 998          * @param remote                remote kmaddress
 999          */
1000         void (*set_kmaddress) (ike_sa_t *this, host_t *local, host_t *remote);
1001
1002         /**
1003          * Create enumerator over a task queue of this IKE_SA.
1004          *
1005          * @param                               queue type to enumerate
1006          * @return                              enumerator over task_t
1007          */
1008         enumerator_t* (*create_task_enumerator)(ike_sa_t *this, task_queue_t queue);
1009
1010         /**
1011          * Flush a task queue, cancelling all tasks in it.
1012          *
1013          * @param queue                 queue type to flush
1014          */
1015         void (*flush_queue)(ike_sa_t *this, task_queue_t queue);
1016
1017         /**
1018          * Queue a task for initiaton to the task manager.
1019          *
1020          * @param task                  task to queue
1021          */
1022         void (*queue_task)(ike_sa_t *this, task_t *task);
1023
1024         /**
1025          * Inherit all attributes of other to this after rekeying.
1026          *
1027          * When rekeying is completed, all CHILD_SAs, the virtual IP and all
1028          * outstanding tasks are moved from other to this.
1029          *
1030          * @param other                 other IKE SA to inherit from
1031          */
1032         void (*inherit) (ike_sa_t *this, ike_sa_t *other);
1033
1034         /**
1035          * Reset the IKE_SA, useable when initiating fails
1036          */
1037         void (*reset) (ike_sa_t *this);
1038
1039         /**
1040          * Destroys a ike_sa_t object.
1041          */
1042         void (*destroy) (ike_sa_t *this);
1043 };
1044
1045 /**
1046  * Creates an ike_sa_t object with a specific ID and IKE version.
1047  *
1048  * @param ike_sa_id             ike_sa_id_t to associate with new IKE_SA/ISAKMP_SA
1049  * @param initiator             TRUE to create this IKE_SA as initiator
1050  * @param version               IKE version of this SA
1051  * @return                              ike_sa_t object
1052  */
1053 ike_sa_t *ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator,
1054                                                 ike_version_t version);
1055
1056 #endif /** IKE_SA_H_ @}*/