Moby Dick Consolidated System Integration Plan

D0103v1.doc Version 1 6.7.2003
The above means that you will use up four SPI's for an ESP only connection (two for incoming and
outgoing ESP SA's, two for incoming and outgoing IPIP SA's) and six SPI's for an AH or Ah+ESP
connection (additionally two SPI's for incoming and outgoing AH SA's).
Once you have set up the ipsec_conn structure properly, you can create a connection by calling
IPSecMgr::add_conn(). Since liburp will make copies of any data it needs, you can reuse the same
structure variable again and again (after changing the required members, of course). This also implies that
you are responsible for managing the memory (keys, etc.) used by your variable.
The IPsecMgr::add_conn() method returns a 'connection-id': a non-negative integer identifying the
connection. This id can be used to call IPSecMgr::del_conn(), to destroy the connection. Note: calling
IPSecMgr::exit() also destroys all connections which have not been released by calling
IPSecMgr::del_conn().
4.2.3.6.2 SPI Management
Since one needs to have unique SPI's for each connection, and should then return them to the unused SPI
'pool' for later re -use after destroying a connection (lest you run out of SPI's), liburp provides a SPI
management interface.
You can ask for unique SPI's by calling PFKey::get_spi() as many times as required: it will ensure that
you only get unique PI's, and will return 0 if no SPI is available.
Once you have done with an SPI, free it by calling PFKey::free_spi(). PFKey will then re-use it if
necessary.
Note: IPSecMgr::del_conn() does not automatically free the SPI's used by a connection: you must still
call PFKey::free_spi().
Note that the SPI management routines can only ensure that SPI's are unique within a single process.
There is no mechanism to ensure SPI uniqueness system-wide. Thus, if there is another program using the
PF_KEY (RFC 2367) interface to use SPI's, then conflict is likely. To be safe, liburp uses the SPI range
0x100 to 0xfff, which is reserved for manual keying. This will ensure that at least liburpallocated SPI's
do not conflict with those used by some key-management daemon like FreeS/WAN's pluto.
4.2.3.6.3 Firewall control
The Access Router has to implement a packet filter that would drop packets sent from unauthenticated
mobile hosts. This is achieved via the pep6_kmod kernel filter. This is a kernel module provided with the
library. You must compile and insert this mo dule into the kernel to use the packet filter functions of
librup. This library provides a simple interface to the kernel filter rules through the class
URPFWMgr. The philosophy of the kernel filter is to not allow Any packets to be forwarded, except
those from or to addresses Specified in a “rule". Each rule is associated with an interface. The wildcard
"any" interface is also allowed, to create global rules.
Call URPFWMgr::init() to initialize the firewall manager. The kernel module must be loaded for this to
success.
Call URPFWMgr::allow6() to allow forwarding for a particular mobile node. 'in_dev' is the name of the
network interface the rule should be associated with ("eth0", "wlan0", etc. for example). Using "any" as
the interface name causes the rule to be associated with all interfaces. 'v6addr' is the source or destination
address of the packets for which forwarding is enabled, and should be the care-of-address of the mobile
node.
URPFWMgr::forbid6() serves to disable the forwarding enabled by calling allow6(). It takes only a single
argument, which is the address the rules should be revoked. All rules containing this address will be
removed.
All these functions return 0 if the operation was successful; otherwise they return an integer less than 0.
4.2.3.6.4 2.2.2.4 API Synopsis
The API is summarized here.
#include
static void Logger::setDefaults(const char *ident,
const bool tid = false, const int facility = DAEMON)
static void Logger::setDebugState(bool state)
static int IPSecMgr::init()
static int IPSecMgr::add_conn(struct ipsec_conn *conn)
static int IPSecMgr::del_conn(int connid)
static int IPSecMgr::exit()
D0103v1.doc 69 / 168