IPsec/IKE Strong End System Model Implications

Table of Contents >> IPsec/IKE Programmer's Reference

RFC 1122 describes two different routing models for multihoming. One is the Strong End System Model, the other is the Weak End System Model. Treck TCP/IP supports both. The details related to these features can be found in Appendix C: Strong End System Model / Weak End System Model. However, the following sections describe additional information required for use of the Strong End System Model with IPsec.

IPsec API and Structure Changes for the Strong End System Model

Many functions and/or structures have specific needs when using the Strong End System Model. In most cases, an interface handle has been added. This is returned when calling tfAddInterface().

IPsec and Ports

To use the Strong End System Model with IPsec, start IKE with a non-NULL interface handle:

 
int tfStartIke(unsigned int ipaddrType,
                unsigned int ipaddrLength,
                ttUserVoidPtr ipaddrPtr
#ifdef TM_USE_STRONG_ESL
                ,ttUserInterface interfaceHandle
#endif /* TM_USE_STRONG_ESL */
);
 

 
int tfStartEnhancedIke( unsigned int idType,
                        unsigned int idLength,
                        ttUserVoidPtr idPtr,
                        const struct sockaddr_storage TM_FAR * ikeSockaddrPtr
#ifdef TM_USE_STRONG_ESL
                        ,ttUserInterface interfaceHandle
#endif /* TM_USE_STRONG_ESL */
);
 

Note:

interfaceHandle is used for IKE rekeying. This is returned from tfAddInterface().

The concept of a port has been added for use of the Strong End System Model with IPsec. Physical ports are set for a given interface. This provides a means to specify the interfaces for which a given IPsec Policy is valid. This is done through the use of a port mask in the IPsec selector. The port mask uses a bit for each port on which the IPsec Policy is valid. Bit 0 is for port 0, bit 1 for port 1, etc. A port mask of 0x00 is a wildcard. The following API is used to manage ports, masks, and interface associations.

 
#ifdef TM_USE_STRONG_ESL
/* User sets a physical port for a given interface */
TM_PROTO_EXTERN int tfInterfaceSetPhysPort(ttUserInterface interfaceHandle,
                                            int physPort );
 
/* Get the physical port for a given interface */
TM_PROTO_EXTERN int tfInterfaceGetPhysPort(ttUserInterface interfaceHandle);
 
/* Get the physical port mask for a given interface */
TM_PROTO_EXTERN ttUser32Bit tfInterfaceGetPortMask(ttUserInterface interfaceHandle);
 
/* Get a configured interface handle given a sock addr and phys port */
TM_PROTO_EXTERN ttUserInterface tfInterfaceGetFromAddrPhysPort(ttConstSockAddrStoragePtr sockAddrStoragePtr,
                                                                int physPort);
 
/* Get configured iface handle given sock addr and phys port mask */
TM_PROTO_EXTERN ttUserInterface tfInterfaceGetFromAddrPortMask(ttConstSockAddrStoragePtr sockAddrStoragePtr,
                                                                ttUser32Bit portMask);
/* Given an iface handle store null terminated name in namePtr */
TM_PROTO_EXTERN int tfInterfaceName(ttUserInterface interfaceHandle,
                                        ttUserCharPtr namePtr,
                                        int nameLen);
/* Given a device name return the corresponding interface handle */
TM_PROTO_EXTERN ttUserInterface tfInterfaceNameToDevice(ttUserConstCharPtr namePtr);
#endif /* TM_USE_STRONG_ESL */
 
 

Table of Contents >> IPsec/IKE Programmer's Reference