tfSadbRecordManualAddByPriority

Table of Contents >> IPsec/IKE Programmer's Reference >> IPsec/IKE Function Reference

#include <trsocket.h>

int tfSadbRecordManualAddByPriority	(
	ttUser16Bit priority,
	ttUser32Bit inboundIndex,
	ttUser32Bit outboundIndex,
	const char * inboundKeyPtr,
	ttUser32Bit inboundKeyLength,
	const char * outboundKeyPtr,
	ttUser32Bit outboundKeyLength,
	ttUser8Bit innermostSa
	);

Function Description

This function is used to create manual SA bundles. Note that each call generates a pair of manual SAs - one in each direction (this differs from the pre-existing manual SA interface which requires a call for each direction).

Usage

When creating policy bundles, policy content is added in an outermost-to-innermost fashion. This call is designed to create manual SAs in outermost-to-innermost fashion matching the order in which policy content is added. Thus, the first call creates a manual SA for the policy content that is created with the first call to tfPolicyAdd() or tfPolicyAddWithUserData(), and subsequent calls create manual SAs that go along with each corresponding content created when calling tfPolicyAddBundle(). Therefore, you can create one policy content then follow it up with a call to create the corresponding manual SA or, optionally, the entire policy bundle can be created with iterative calls to tfPolicyAdd() or tfPolicyAddWithUserData() and, at completion, each corresponding manual SA can be created with iterative calls to tfSadbRecordManualAddByPriority(). This function will automatically associate each new manual SA with the first available policy content that does not already have a manual SA assigned to it, searching from outermost-to-innermost content.

When adding the final manual SA (innermost), set innermostSa = TM_8BIT_YES (else use TM_8BIT_NO) to insure that the proper SA timers and management resources are properly setup for the bundle. Note that, when using Treck lifetime timers, these timers start at the completion of the call.

When all policy content and all manual SAs have been added, call tfPolicyValidate() or tfPolicyValidateByPriority() to validate and enable the bundle (or optionally call tfPolicyAddBundle() with a NULL policy content pointer).

Parameters

• priority

  This is the priority of the policy that contains content to be bundled.

• inboundIndex

  This is the inbound SPI assigned to the manual IPsec SA that is generated by this call.

• outboundIndex

  This is the outbound SPI assigned to the manual IPsec SA that is generated by this call.

• inboundKeyPtr

  This is the caller-allocated buffer that contains the keying material for the inbound SA that is generated by this call.

• inboundKeyLength

  This is the length of the caller-allocated buffer, inboundKeyPtr.

• outboundKeyPtr

  This is the caller-allocated buffer that contains the keying material for the outbuond SA that is generated by this call.

• outboundKeyLength

  This is the length of the caller-allocated buffer, outboundKeyPtr.

• innermostSa

  This is TM_8BIT_YES when the call is made to create the innermost SA in the bundle. Else, this is set to TM_8BIT_NO.

Returns

• TM_ENOERROR

  This indicates success.

• TM_EIPSECNOTINITIALIZED

  This indicates failure because IPsec has not been started.

• TM_EINVAL

  This indicates failure because one or more of the parameters is invalid.

• TM_ENOBUFS

  This indicates failure because of a memory allocation error.

Table of Contents >> IPsec/IKE Programmer's Reference >> IPsec/IKE Function Reference