tfSadbRecordManualAdd

Table of Contents >> IPsec/IKE Programmer's Reference >> IPsec/IKE Function Reference

#include <trsocket.h>

int tfSadbRecordManualAdd	(
	ttSadbRecordPtrPtr sadbPtrPtr,
	ttUser8Bit direction,
	ttUser32Bit spi,
	ttIpsecSelectorInStringPtr selStrPtr,
	int plcyContentIndex,
	const char TM_FAR * manualKeyPtr,
	ttUser32Bit keyLength
	);

Function Description

This procedure is used to generate one SA manually. User is responsible to provide all the information in order to generate this SA, such as the direction, SPI number, selector, the corresponding policy content, and key materials. The SA will be inserted into the SAD hash table. You may use tfSadbRecordGenerate to manually add IPsec SA too.

Parameters

• saPtrPtr

  For output use. Carries the address of SA just generated.

• direction

  The direction of the to-be-generated SA, can be either TM_IPSEC_INBOUND or TM_IPSEC_OUTBOUND

• spi

  The SPI value of the interested SA, must be greater than 255.

• selStrPtr

  Pointer to the selector information

• plcyContentIndex

  The value of policy content index. Each policy content in the SPD table has a unique policy content index. We use this index to find the corresponding policy

• manualKeyPtr

  Pointer to the key material, this key material should include everything needed to generate this SA. For example, if both encryption and hashing needed for this SA to be generated, the key material should include encryption key and hashing key. Encryption key comes first and hashing key is appended right after the encryption key. Note that you can only use default key length for each algorithm, if you want key length other than the default one, you have to call tfSadbRecordGenerate.

• keyLength

  Key material length. This is the total length of both encryption key and hashing key. You are allowed to provide a key material longer than necessary.

Returns

• TM_ENOERROR

  An SA is successfully constructed. saPtrPtr contains the new SA pointer’s address.

• Other value

  Error. saPtrPtr will contain NULL pointer

Example

Suppose our policy reads: From 1.1.1.0/24 to 2.2.2.1, any port, any protocol, ESP tunnel from 1.1.1.1 to 2.2.2.1. Using DES-CBC for encryption, and MD5-HMAC hashing. Different protocol uses different SA. We want to manually add SA’s according to this policy. Since different protocol is going to use different SA. Here, we just add SA to support UDP traffic. In order to protect TCP, ICMP etc, user is responsible to add the corresponding inbound and outbound SA’s.

 
{
    tt8Bit          keyMatInbound[]=
                           "abcdefghijklmnopqrstabcdefghijklmnopqrstuvwx";
    tt8Bit          keyMatOutbound[]=
                           "1234efghIJKLmnopGRSTabcdEFGHijklMNOPqrst4321";
    ttSadbRecordPtr sadbPtr;
    int             errorCode;
    int             policyContentIndex;
    ttIpsecSelectorInString saSelector = 
/* SA selector: From 1.1.1.0/24 to 2.2.2.1, any port, UDP protocol, please
 * notice that saSelector is maybe different with the policySelector. They
 * could be the same, but in many cases, saSelector is more specific than
 * policySelector. Such as this example, saSelector MUST specify a unique
 * protocol—UDP, but the policySelector just specifies a
 * TM_SELECTOR_WILD_PROTOCOL, see examples in tfPolicyRestore. All
 * protocol uses the same policy, but each protocol MUST has its own IPsec
 * SA, according to the policy content */
    {
        "1.1.1.0",              (int)"255.255.255.0",
        "2.2.2.1",              0,
        TM_SELECTOR_LOCIP_SUBNET + TM_SELECTOR_REMTIP_HOST,
        TM_SELECTOR_WILD_PORT,  TM_SELECTOR_WILD_PORT,
/* you CAN’T use wild value here to generate IPsec SA */
        IPPROTO_UDP 
    };
/* add SA according to the policy content #1. In order to know the right
 * policy content index, please refer to the example in section 4.4.1
 * tfPolicyRestore */
    policyContentIndex = 1;
/* add inbound SA, using SPI = 1000 */
    errorCode = tfSadbRecordManualAdd(&sadbPtr,
                                      TM_IPSEC_INBOUND,
                                      1000,
                                      &saSelector,
                                      policyContentIndex,
                                      (const char *)keyMatInbound,
/* DES-CBC + MD5-HMAC requires 8+ 16 = 24 bytes key material, you have to
 * provide at least 24 bytes. 44 is OK. */
                                      44);
    if (errorCode)
    {
        goto COMMON_RETURN;
    }
/* add outbound SA, using SPI = 1100 */
    errorCode = tfSadbRecordManualAdd(&sadbPtr,
                                      TM_IPSEC_OUTBOUND,
                                      1100,
                                      &saSelector,
                                      policyContentIndex,
                                      (const char *)keyMatOutbound,
                                      44);
    if (errorCode)
    {
        goto COMMON_RETURN;
    }
...
}
 

Note:

Do not use TM_IPSEC_BOTH_DIRECTION for the direction variable. Different direction will be using different keying material (resulting from different SPI, see RFC 2409 for details).

Table of Contents >> IPsec/IKE Programmer's Reference >> IPsec/IKE Function Reference