tfIpsecSetOptions

Table of Contents >> IPsec/IKE Programmer's Reference >> IPsec/IKE Function Reference

#include <trsocket.h>

int tfIpsecSetOptions	(
	ttUser32Bit option,
	ttUser8Bit value
	);

Function Description

This function is used to change Treck IPsec/IKE behavior during the running time. Most of these behaviors can be achieved by defining corresponding macros. tfIpsecSetOptions() provides a convenient way to change the IPsec/IKE behavior without having to recompile the whole stack. This function must be called after tfUseIpsec() call.

Parameters

• option

  Identifies the option user wants to change. Refer to the table below for valid options.

• value

  Set the option value. In most cases, a non-zero value will enable the option, a zero value disables the option. For option like TM_IPSECOPT_AGGRESSDHGROUP, value can be 1, 2, 5 or 14, which corresponds to DH group 1, 2, 5, and 14 respectively.

Option	Description
TM_IPSECOPT_ANTIREPLAY	Anti-replay: 1 enables anti-replay, 0 disables it.
TM_IPSECOPT_PFSKEY	Perfect Forward Secrecy: 1 enables PFS, 0 disables it.
TM_IPSECOPT_AGGRESS	Aggressive mode in IKE phase 1: 1 enables it, 0 disables it.
TM_IPSECOPT_AGGRESSDHGROUP	The Diffie-Hellman group to be used in aggressive mode. Value must be 1, 2, 5 or 14.
TM_IPSECOPT_INITCONTACT	Initial Contact: 1 enables IKE to send the Initial Contact message upon finishing IKE phase 1 negotiation, 0 disables it.
TM_IPSECOPT_ICMPBYPASS	Bypass all ICMP packets or not. 1 bypasses IPsec processing for all ICMP packets.
TM_IPSECOPT_ICMPSRCCHKBYPASS	ICMP source address checking. 1 bypasses checking of the source address against the IPsec policy.
TM_IPSECOPT_ICMP6NDMLDBYPASS	ICMPv6 source address checking. 1 bypasses checking of the source address against the IPsec policy.
TM_IPSECOPT_NESTIKE_BYPASS	Nested IKE packet checking. 1 bypasses all IPsec policy checking of nested IKE packets. 0 forces all IKE packets to undergo IPsec policy checking.
TM_IPSECOPT_DFBIT	Set the outside IP header's Don't Fragment bit if a tunnel is used. Valid values can be TM_IPSEC_DFBIT_CLEAR, TM_IPSEC_DFBIT_SET or TM_IPSEC_DFBIT_COPY.
TM_IPSECOPT_ONLY_WHEN_REQUIRED	Globally enable or disable IPsec policy strictness. By default, IPsec policies enforce strict adherence on any peer that matches the policy selector. Set a non-zero value for this option to allow policies to be used only when a peer requires IPsec (by initiating IKE). This option allows a Treck application to communicate with IPsec and non-IPsec peers whose IP addresses are not known in advance. Note: To enable this feature for a given policy you must also define TM_IPSEC_ONLY_WHEN_REQUIRED in trsystem.h and call tfPolicySetOptions() to set option TM_IPSEC_PLCYOPT_ONLY_WHEN_REQD for the policy.

Returns

• TM_ENOERROR

  Success.

• -1

  tfIpsecSetOptions() call failed

Example

This example sets some IPsec options. Please note that tfUseIpsec() is called before this function call.

 
{
...
    errorCode = tfUseIpsec();
 
/* Set IPsec options AFTER you call tfUseIpsec */
 
/* don't use Perfect Forward Secrecy feature */
    tfIpsecSetOptions(TM_IPSECOPT_PFSKEY, 0);
/* use aggressive mode to negotiate IKE phase 1 */
    tfIpsecSetOptions(TM_IPSECOPT_AGGRESS, 1);
/* aggressive mode use DH group #2 */
    tfIpsecSetOptions(TM_IPSECOPT_AGGRESSDHGROUP, 2);
/* don't send initial contact. */
    tfIpsecSetOptions(TM_IPSECOPT_INITCONTACT, 1);
...
}
 

Table of Contents >> IPsec/IKE Programmer's Reference >> IPsec/IKE Function Reference