tfIpsecPolicyQueryBySelector

Table of Contents >> IPsec/IKE Programmer's Reference >> IPsec/IKE Function Reference

#include <trsocket.h>

int tfIpsecPolicyQueryBySelector	(
	ttUser32Bit options,
	ttIpsecSelectorPtr pktSelectorPtr,
	ttPolicyEntryPtrPtr plcyPtrPtr,
	ttUser8Bit direction
	);

Function Description

This function locates the policy used to protect packets that have selector value pktSelectorPtr. Per RFC requirement, the first matched policy will be returned.

Parameters

• options

  This variable is not used currently.

• pktSelectorPtr

  The selector value of interested packet.

• plcyPtrPtr

  For output use. Carries the address of policy just found.

• direction

  Specifies inbound or outbound policy, can be either TM_IPSEC_INBOUND or TM_IPSEC_OUTBOUND, (CANNOT be TM_IPSEC_BOTHDIRECTION here)

Returns

• TM_ENOERROR

  Policy located successfully. Policy pointer stored in plcyPtrPtr.

• Other value

  Error code and plcyPtrPtr carries a NULL pointer

Example: This example tries to locate the OUTBOUND policy that is used to protect TCP packet from 1.1.1.100 port 3500 to 2.2.2.1 port 21.

 
{
    ttIpsecSelector  selector;
    ttPolicyEntryPtr plcyPtr;
    int              errorCode;
 
/* initialize the memory */
    tm_bzero(&selector, sizeof(ttIpsecSelector));
 
/* set the selector */
    selector.selLocIp1.ss_family = PF_INET;
    selector.selLocIp1.ss_len = sizeof(struct sockaddr_in);
    selector.selRemtIp1.ss_family = PF_INET;
    selector.selRemtIp1.ss_len = sizeof(struct sockaddr_in);
    selector.selLocIp1.addr.ipv4.sin_addr.s_addr  =
                                                  inet_addr("1.1.1.100");
    selector.selRemtIp1.addr.ipv4.sin_addr.s_addr = inet_addr("2.2.2.1");
    selector.selRemtPort = htons(21);
    selector.selLocPort  = htons(3500);
    selector.selProtocol = TM_IP_TCP;
    selector.selIpFlags  = TM_SELECTOR_LOCIP_HOST +
                           TM_SELECTOR_REMTIP_HOST; 
 
/* call tfIpsecPolicyQueryBySelector */
    errorCode = tfIpsecPolicyQueryBySelector(0,
                                             &selector,
                                             &plcyPtr,
                                             TM_IPSEC_OUTBOUND);
 
/* ... */
}
 

Note:

This function is called by TCP/IP kernel to determine the policy used. It is listed in public document for debug usage.

Table of Contents >> IPsec/IKE Programmer's Reference >> IPsec/IKE Function Reference