Struct:ttPolicyContentInString
#include trsecapi.h typedef struct tsPolicyContentInString{ /* for router, it may have multiple ip, need to specify */ char TM_FAR * pctstrLocIpAddr; char TM_FAR * pctstrRemtIpAddr; /* AH|ESP, tunnel|transport, policy|packet determination */ ttUser32Bit pctstrRuleFlags; /* esp may also have authentication algorithm*/ ttUser16Bit pctstrAuthAlg; ttUser16Bit pctstrEncryptAlg; #ifdef TM_USE_IPSEC_IPCOMP ttUser8Bit pctstrIpcompAlg; #endif /* TM_USE_IPSEC_IPCOMP */ /* BUG 565, we decide to add the following two fields of lifetime*/ /* lifetime value in seconds. zero value(0) means to use the * default value TM_IPSECSA_TLIFETIME_DEFAULT */ ttUser32Bit pctstrLifeSeconds; /* lifetime value in kilo bytes. zero value(0) means to use the * default value TM_IPSECSA_VLIFETIME_DEFAULT */ #ifdef TM_USE_IPSEC_64BIT_KB_LIFETIMES ttUser64Bit pctstrLifeKbytes; #else /* TM_USE_IPSEC_64BIT_KB_LIFETIMES */ ttUser32Bit pctstrLifeKbytes; #endif /* TM_USE_IPSEC_64BIT_KB_LIFETIMES */ #ifdef TM_USE_STRONG_ESL ttUser32Bit pctstrPortMask; #endif /* TM_USE_STRONG_ESL */ /* encryption algorithm key length in bits. 0 means to use the * the default key length */ ttUser16Bit pctstrEncryptKeyBits; #ifdef TM_USE_MULTIPLE_PROPOSALS ttUser8Bit pctstrProposalNumber; ttUser8Bit pctstrTransformNumber; #endif /* TM_USE_MULTIPLE_PROPOSALS */ /* Phase 2 PFS DH Group - 0 means Phase 2 PFS is disabled */ ttUser8Bit pctstrP2PfsDhGroup; } ttPolicyContentInString; typedef ttPolicyContentInString TM_FAR * ttPolicyContentInStringPtr;
Contents
Structure Description
This structure will be used when calling tfPolicyRestore(). It specifies the policy contents.
Members
- pctstrLocIpAddr
- Tunnel address at the local side. We use local and remote rather than source and destination because the policy content also applies to inbound traffic. Must be IPv4 or IPv6 address string, like "1.1.1.1" or "3FFF::1". If this policy content is for transport mode, this member variable is not used. The user may use (char*)0.
- pctstrRemtIpAddr
- Tunnel address at the remote side. Must be IPv4 or IPv6 address string. For transport mode policy content, this member is not used.
- pctstrRuleFlags
- Specifies the policy rules. This is a 32 bit value, and the bits are defined as the following way: (the lowest significant bit is bit 0)
- See the macro definitions in the Table 1 below.
- pctstrAuthAlg
- Specifies the authentication algorithm used. See Table 2 below.
- pctstrEncryptAlg
- Specifies the encryption algorithm used. See Table 3 below
- pctstrIpcompAlg
- Specifies the IP Compression algorithm. Treck IKE has the ability to negotiate IP Compression, but does not have native IP Compression support.
- pctstrLifeSeconds
- Specifies the lifetime in seconds of IPsec SA's which are generated according to this policy content. If the value is zero, we will use the default value 43200 seconds, i.e. 12 hours. The value should be no less than TM_IPSECSA_TLIFETIME_MIN (120 seconds) and no greater than TM_IPSECSA_TLIFETIME_MAX (43200 seconds).
- pctstrLifeKbytes
- pctstrPortMask
- Physical port mask.
- pctstrEncryptKeyBits
- pctstrProposalNumber
- Proposal Number
- pctstrTransformNumber
- Transform Number
- pctstrP2PfsDhGroup
- Diffie-Hellman Groupt to be used for Phase 2 Perfect Forward Secrecy (PFS).
Policy Rule Macro Definitions
| Macro Name (in bits) | Value | Description |
| TM_PFLAG_TUNNEL | 0x01 | set means tunnel mode |
| TM_PFLAG_TRANSPORT | 0x02 | set means transport mode, you can't set both tunnel and transport |
| TM_PFLAG_AH | 0x04 | set means AH |
| TM_PFLAG_ESP | 0x08 | set means ESP. You can't set both AH and ESP, you must use another policy content to achieve both AH and ESP. |
| TM_PFLAG_RIP_PACKET | 0x10 | set means each distinct remote IP needs its own SA. Prohibit IP address sharing. See RFC 2401, 4.4.1 |
| TM_PFLAG_RPT_PACKET | 0x20 | set means each distinct remote port needs its own SA. Prohibit port sharing. |
| TM_PFLAG_LIP_PACKET | 0x40 | set means each distinct local ip needs its own SA. Prohibit local ip sharing. |
| TM_PFLAG_LPT_PACKET | 0x80 | set means each distinct local port needs its own SA. Seldom used. |
| TM_PFLAG_PROTO_PACKET | 0x0100 | set means each distinct protocol needs its own SA. Prohibit protocol sharing |
| TM_PFLAG_BYPASS | 0x0200 | set means bypass IPsec policy check |
| TM_PFLAG_DISCARD | 0x0400 | set means discard the matched packet |
| TM_PFLAG_LOCIP_DNS_NAME | 0x0800 | set means the local IP uses a DNS name. |
| TM_PFLAG_REMTIP_DNS_NAME | 0x1000 | set means that the remote IP uses a DNS name. |
| TM_PFLAG_LOG | 0x2000 | set means log the matched traffic, see tfUseIpsecLogging() |
| TM_PFLAG_MIPV6_HA_TUNNEL | 0x4000 | This policy is used for the tunneling interface between MN's Care of address and Home Agent |
 Note:
|
To specify AH tunnel, pctRuleFlags = TM_PFLAG_AH + TM_PFLAG_TUNNEL |
Authentication Algorithm Macro Definitions
| Macro Name (in bits) | Value | Description |
| SADB_AALG_NONE | 0 | NULL auth algorithm |
| SADB_AALG_MD5HMAC | 1 | md5_hmac_96 |
| SADB_AALG_SHA1HMAC | 2 | sha1_hmac_96 |
| SADB_AALG_RIPEMDHMAC | 3 | ripemd_hmac_96 |
| SADB_AALG_SHA256HMAC | 5 | sha256_hmac_128/96 |
| SADB_AALG_SHA384HMAC | 6 | sha384_hmac_192/96 |
| SADB_AALG_SHA512HMAC | 7 | sha512_hmac_256/96 |
Encryption Algorithm Macro Definitions
| Macro Name (in bits) | Value | Description |
| SADB_EALG_NONE | 0 | NULL algorithm |
| SADB_EALG_DESCBC | 2 | |
| SADB_EALG_3DESCBC | 3 | |
| SADB_EALG_RC5CBC | 4 | |
| SADB_EALG_CAST128CBC | 6 | |
| SADB_EALG_BLOWFISHCBC | 7 | |
| SADB_EALG_NULL | 11 | NULL algorithm |
| SADB_EALG_RIJNDAELCBC | 12 | i.e. AES algorithm |
| SADB_EALG_TWOFISHCBC | 13 |
| Note:
|
SADB_EALG_NONE and SADB_EALG_NULL will be treated the same way. IDEA algorithm is not supported simply because of the patent problem. DES_IV64 is same as DES. |
Examples
/* Example 1, BYPASS policy content */ ttPolicyContentInString pc1 = { (char*)0, (char*)0, TM_PFLAG_BYPASS, 0, 0, 0, 0 }; /* Example 2, ESP tunnel, local side "3fff::1", remote "3fff::2", * using DES_CBC + MD5_HMAC authentication algorithm. SA uses policy * value (sharing SA as much as possible) */ ttPolicyContentInString pc2 = { "3fff::1", "3fff::2", TM_PFLAG_ESP + TM_PFLAG_TUNNEL, SADB_AALG_MD5HMAC, SADB_EALG_DESCBC, 0, /* use the default lifetime value in seconds */ 0 /* use the default lifetime value in Kbytes */ }; /* Example 3, AH transport, using SHA1_HMAC authentication * algorithm. The protocol and remote IP address uses packet value * (means for each distinct protocol and each distinct remote IP * address, uses different SA), log the traffic. IPsec SA generated * according to this policy content will have lifetime 300 seconds * or 100kilo-bytes, whichever comes first. */ ttPolicyContentInString pc3 = { (char *)0, (char *)0, TM_PFLAG_AH + TM_PFLAG_TRANSPORT + TM_PFLAG_PROTO_PACKET + TM_PFLAG_RIP_PACKET + TM_PFLAG_LOG, SADB_AALG_SHA1HMAC, 0, 300, /* use lifetime value 300 seconds */ 100 /* use lifetime value 100 kilo-bytes */ };
