IPsec/IKE Function Reference

Table of Contents >> IPsec/IKE Programmer's Reference

IPsec and IKE initialization

IPsec and IKE initialization procedure allocates memory for the IPsec and IKE global variables. To use IPsec, you must define TM_USE_IPSEC macro in trsystem.h. To use IKE, you must define TM_USE_IKE macro in <trsystem.h>.

tfUseIpsec() tfStartIke() tfStartEnhancedIke()

tfIpsecUninitialize() tfIpsecSetOptions()

Pre-shared Key Management API

tfPresharedKeyAdd() tfPresharedKeyDelete() tfPresharedKeyClear()

PKI APIs

For PKI APIs please see the PKI page.

ISAKMP Policy Management API

ISAKMP Policy means the IKE phase 1 policy in this document. In order for different IKE implementations to communicate and then negotiate to each other, they must agree with each other regarding the phase 1 parameters, such as hash algorithm, encrypt algorithm, Diffie-Hellman group, authentication method and lifetime type and value. After they agree with these phase 1 policy parameters (ISAKMP policy), they can establish phase 1 SA's, i.e. ISAKMP SA's. All phase 2 negotiation (i.e. IPsec SA negotiation) must be protected by the ISAKMP SA's.

As an IKE responder, TRECK IKE accepts any combination of supported algorithms and parameters. Such as MD5+DES+DHGROUP2, SHA1+3DES+DHGROUP5 or MD5+AEE+DHGROUP2. As an IKE initiator, TRECK IKE is able to send up to two transforms user configured using API in this section. If user didn't configure any transform, IKE will use the following default transform as its proposal.

 
{
    TM_IKE_3DES_CBC,
    TM_IKE_SHA1,
    TM_IKE_PRESHARED_KEY,
    TM_DHGROUP_2,
    86400, /* lifetime in seconds */
    32768, /* lifetime in Kbytes */
    0
}
 

For export version, it uses DES + MD5 + Preshared_key + GROUP1 and the same lifetime value.

tfIkeAddPhase1Transform() tfIkeDeletePhase1Transform() tfIkePolicyAddByPriority() tfIkePolicyDeleteByPriority() tfIkePolicyRestore()

IPsec Policy Database Management API

If IPsec is used, all traffic is subject to policy check including incoming and outgoing, IPsec-protected, and non-IPsec-protected traffic. The policy must be there in order to receive or send packets (a simple policy example is that: For any source to any destination we BYPASS IPsec).

tfIpsecPolicyQueryBySelector() tfIpsecPolicyQueryByIndex() tfPolicyAdd() tfPolicyAddBundle() tfPolicyAddWithUserData() tfPolicyClear()

tfPolicyDelete() tfPolicyDeleteByPriority() tfPolicyRestore() tfPolicySetOptions() tfPolicyValidate() tfPolicyValidateByPriority()

IKE SA Database Management API

tfIkeClearSas() tfIkeClearSasByPriority() tfIkeDeletePhase1SAByInterface()

IPsec SA Database Management API

If TM_USE_IKE is defined, the SAD management, such as adding and deleting an SA, will be done by IKE automatically. If manual keying is used, the following API will be used to access the SAD hash table.

tfSadbRecordGenerate() tfSadbRecordDelete() tfSadbRecordDeleteByPolicy() tfSadbRecordDeleteByDestination() tfSadbRecordClear() tfSadbRecordClearAll() tfSadbRecordClearByPriority()

tfSadbRecordGet() tfSadbRecordGetByPolicy() tfSadbRecordFind() tfSadbRecordSetOptions() tfSadbRecordManualAdd() tfSadbRecordManualAddByPriority()

Log Function API

tfUseIpsecLogging() tfIpsecLogWalk()

Enhanced Log Function API

tfLogGetLevel() tfLogSetLevel() tfLogSetVerbosity() tfTreckLogWrite()

Hardware Acceleration

IPsec calculations, including encryption/decryption, authentication, Diffie-Hellman exchanges, public key calculation (DSA or RSA), are all highly CPU intensive tasks. Hardware accelerator may be used to accelerate the process.

tfCryptoEngineRegister() tfCryptoEngineDeRegister() tfCryptoEngineAddAlgorithm()

Independent IPsec/IKE Tasks

tfIkeUserExecute() tfUserIpsecExecute() tfUserIpsecHandoffExecute()

Asynchronous Cryptography Support

tfCryptoAsyncSignal() tfCryptoAsyncSignalIsr() tfCryptoAsyncWait()

Table of Contents >> IPsec/IKE Programmer's Reference