Struct:ttIpsecSelectorInString

 
#include trsecapi.h
 
typedef struct tsIpsecSelectorInString
{
    char TM_FAR * selstrLocIp1;
    union
    {
        int           selstr_loc_prefix_length;
        char TM_FAR * selstr_loc_ip2;
    } selstrLocIp2Union;
    char TM_FAR * selstrRemtIp1;
    union
    {
        int           selstr_remt_prefix_length;
        char TM_FAR * selstr_remt_ip2;
    } selstrRemtIp2Union;
    ttUser16Bit selstrIpFlags;
/* local port and remote port */
    ttUser16Bit selstrLocPort;
    ttUser16Bit selstrRemtPort;
    ttUser16Bit selstrProtocol;
#define selstrLocPrefixLength selstrLocIp2Union.selstr_loc_prefix_length
#define selstrLocIp2 selstrLocIp2Union.selstr_loc_ip2
#define selstrRemtPrefixLength selstrRemtIp2Union.selstr_remt_prefix_length
#define selstrRemtIp2 selstrRemtIp2Union.selstr_remt_ip2
} ttIpsecSelectorInString;
 

Structure Description

When the user wishes to call tfPolicyRestore to bulk-load the policy entries, the user must fill out the selectors. Selector defines the matching criteria including the IP addresses, port number, and protocols. For selectors, we are using local and remote side, rather than source and destination because the selector applies to both inbound traffic and outbound traffic.

Members

• selstrLocIp1

  With selstrLocIp2Union, selstrLocIp1 specifies the IP information for the local side. If local IP selector is a single IP, we need selstrLocIp1 only (we don't care what is selstrLocIp2Union); if local IP selector is a subnet, then selstrLocIp1 indicates the subnet address, and selstrLocIp2Unioin indicates the mask or the prefix length; if local IP selector is an IP range, then selstrLocIp1 is minimum end and selstrLocIp2Union is the maximum end.

• selstrLocIp2Union

  See selstrLocIp1. If this union is assigned an integer value, it means the prefix length (user need specify this in selstrIpFlags), Otherwise, if it is assigned a char pointer, it points to an IP address string.

• selstrRemtIp1

  With selstrRemtIp2Union, selstrRemtIp1 specifies the IP information for the remote side.

• selstrRemtIp2Union

  See selstrRemtIp1 and selstrLocIp2Union

• selstrIpFlags

  Specifies the IP selector type of both the local side and the remote side. See table below for valid flags.

• selstrLocPort

  Local side port number, in host order. Could be TM_SELECTOR_WILD_PORT (0) to indicate this field is a wild value

• selstrRemtPort

  Remote side port number, in host order. Could be TM_SELECTOR_WILD_PORT (0) to indicate this field is a wild value

• selstrProtocol

  The protocol number, Could be TM_SELECTOR_WILD_PROTOCOL (0) to indicate this field is a wild value

Valid Values for selstrIpFlags

Macro Name (in bits)	Value	Description
TM_SELECTOR_LOCIP_HOST	0x01	local ip selector is a host IP address
TM_SELECTOR_REMTIP_HOST	0x02	remote ip selector is a host IP address
TM_SELECTOR_BOTHIP_HOST	0x03	both ip selectors are host IP addresses
TM_SELECTOR_LOCIP_SUBNET	0x04	local ip selector is a subnet
TM_SELECTOR_REMTIP_SUBNET	0x08	remote ip selector is a subnet
TM_SELECTOR_BOTHIP_SUBNET	0x0c	both ip selectors are subnets
TM_SELECTOR_LOCIP_RANGE	0x10	local ip selector is an ip range(min, max)
TM_SELECTOR_REMTIP_RANGE	0x20	remote ip selector is an ip range(min, max)
TM_SELECTOR_BOTHIP_RANGE	0x30	both ip selectors are ip ranges(min, max)
TM_SELECTOR_LOCIP_DNS_NAME	0x40	local ip selector is a domain name
TM_SELECTOR_REMTIP_DNS_NAME	0x80	remote ip selector is a domain name, must be a host name, not subnet or ip ranges
TM_SELECTOR_BOTHIP_DNS_NAME	0xc0	both ip selector are domain name, must be host name, not subnet or ip ranges
TM_SELECTOR_USE_PREFIX_LENGTH	0x100	Use prefix length to specify a subnet

Example

 
/* selector example 1, ANY to ANY */
ttIpsecSelectorInString sel1 =
{
    (char*)0, 0,
    (char*)0, 0,
    (tt16Bit)0 ,
    TM_SELECTOR_WILD_PORT, TM_SELECTOR_WILD_PORT,
    TM_SELECTOR_WILD_PROTOCOL
};
 
/* selector example 2, local side 1.1.1.0/24 to remote side 2.2.2.1, any
* port, any protocol */
ttIpsecSelectorInString sel2 =
{
    "1.1.1.0", (int)"255.255.255.0",
    "2.2.2.1", 0,
    TM_SELECTOR_LOCIP_SUBNET + TM_SELECTOR_REMTIP_HOST,
    TM_SELECTOR_WILD_PORT, TM_SELECTOR_WILD_PORT,
    TM_SELECTOR_WILD_PROTOCOL
};
 
/* selector example 3, local side "foo1.bar1.com" any port to remote side
* "foo2.bar2.com", port 21, TCP protocol */
ttIpsecSelectorInString sel3 =
{
    "foo1.bar1.com", 0,
    "foo2.bar2.com", 0,
    TM_SELECTOR_BOTHIP_DNSNAME,
    TM_SELECTOR_WILD_PORT, 21,
    TM_IP_TCP
};