1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
/**
* @file child_sa.h
*
* @brief Interface of child_sa_t.
*
*/
/*
* Copyright (C) 2005 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef CHILD_SA_H_
#define CHILD_SA_H_
#include <types.h>
#include <crypto/prf_plus.h>
#include <encoding/payloads/proposal_substructure.h>
typedef struct child_sa_t child_sa_t;
/**
* @brief Represents multiple IPsec SAs between two hosts.
*
* A child_sa_t contains multiple SAs. SAs for both
* directions are managed in one child_sa_t object, and
* if both AH and ESP is set up, both protocols are managed
* by one child_sa_t. This means we can have two or
* in the AH+ESP case four IPsec-SAs in one child_sa_t.
*
* The procedure for child sa setup is as follows:
* - A gets SPIs for a proposal via child_sa_t.alloc
* - A send the updated proposal to B
* - B selects a suitable proposal
* - B calls child_sa_t.add to add and update the selected proposal
* - B sends the updated proposal to A
* - A calls child_sa_t.update to update the already allocated SPIs with the chosen proposal
*
* Once SAs are set up, policies can be added using add_policies.
*
*
* @b Constructors:
* - child_sa_create()
*
* @ingroup sa
*/
struct child_sa_t {
/**
* @brief Allocate SPIs for a given proposals.
*
* Since the kernel manages SPIs for us, we need
* to allocate them. If the proposal contains more
* than one protocol, for each protocol an SPI is
* allocated. SPIs are stored internally and written
* back to the proposal.
*
* @param this calling object
* @param proposal proposal for which SPIs are allocated
*/
status_t (*alloc)(child_sa_t *this, linked_list_t* proposals);
/**
* @brief Install the kernel SAs for a proposal.
*
* Since the kernel manages SPIs for us, we need
* to allocate them. If the proposal contains more
* than one protocol, for each protocol an SPI is
* allocated. SPIs are stored internally and written
* back to the proposal.
*
* @param this calling object
* @param proposal proposal for which SPIs are allocated
* @param prf_plus key material to use for key derivation
*/
status_t (*add)(child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus);
/**
* @brief Install the kernel SAs for a proposal, if SPIs already allocated.
*
* This one updates the SAs in the kernel, which are
* allocated via alloc, with a selected proposals.
*
* @param this calling object
* @param proposal proposal for which SPIs are allocated
* @param prf_plus key material to use for key derivation
*/
status_t (*update)(child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus);
/**
* @brief Install the policies using some traffic selectors.
*
* Spplied lists of traffic_selector_t's specify the policies
* to use for this child sa.
*
* @param this calling object
* @param my_ts traffic selectors for local site
* @param other_ts traffic selectors for remote site
* @return SUCCESS or FAILED
*/
status_t (*add_policies) (child_sa_t *this, linked_list_t *my_ts_list, linked_list_t *other_ts_list);
/**
* @brief Destroys a child_sa.
*
* @param this calling object
*/
void (*destroy) (child_sa_t *this);
};
/**
* @brief Constructor to create a new child_sa_t.
*
* @param me own address
* @param other remote address
* @return child_sa_t object
*
* @ingroup sa
*/
child_sa_t * child_sa_create(host_t *me, host_t *other);
#endif /*CHILD_SA_H_*/
|
