/* ipike_policy.h - Public API of Wind River IKE */

/*
 ******************************************************************************
 *                     HEADER FILE
 *
 *     Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_policy.h,v $ $Revision: 1.8.16.3 $
 *     $Source: /home/interpeak/CVSRoot/ipike/src/ipike_policy.h,v $
 *     $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
 *     $State: Exp $ $Locker:  $
 *
 *     INTERPEAK_COPYRIGHT_STRING
 *        Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
 ******************************************************************************
 */
#ifndef IPIKE_POLICY_H
#define IPIKE_POLICY_H

/*
 ****************************************************************************
 * 1                    DESCRIPTION
 ****************************************************************************
 */

/*
DESCRIPTION
This file contains the API used for policy selecting of Wind River IKE.
*/

/*
 ****************************************************************************
 * 2                    CONFIGURATION
 ****************************************************************************
 */

/*
 ****************************************************************************
 * 3                    INCLUDE FILES
 ****************************************************************************
 */

#include "ipike_config.h"
#include "ipike.h"
#include "ipike_payload_sa.h"
#include "ipike_sadb.h"

#ifdef __cplusplus
extern "C" {
#endif

/*
 ****************************************************************************
 * 4                    DEFINES
 ****************************************************************************
 */

/*
 ****************************************************************************
 * 5                    TYPES
 ****************************************************************************
 */

/*
 ****************************************************************************
 * 6                    FUNCTIONS
 ****************************************************************************
 */

/*******************************************************************************
*
* ipike_policy_select_ike_sa_param - select IKE SA parameters for IKE v1
*
* This routine selects IKE SA parameters for IKE v1 from an
* 'ipike_config_ike_sa' configuration structure. It selects the first acceptable
* transforms in the first acceptable proposal in the configuration structure for
* the IKE SA and updates an 'ipike_selected' structure with the selected
* parameters.
*
* Parameters:
* \is
* \i <conf>
* A pointer to the 'ipike_config_ike_sa' configuration structure to be used for
* the IKE SA that is negotiated.
* \i <sa>
* A pointer to an 'Ipike_sa' structure containing the IKE SA that is to be
* accepted or rejected.
* \i <selected>
* A pointer to an 'ipike_selected' structure. When the routine returns, the
* structure is updated with the selected parameters.
* \i <final>
* Set to IP_TRUE if this is a the final selection of SA parameters, i.e.
* if it is initiator that is about to accept the responders selection.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_GLOBAL Ipike_error ipike_policy_select_ike_sa_param
(
    Ipike_config_ike_sa* conf,
    Ipike_sa*            sa,
    Ipike_selected*      selected,
    Ip_bool              final
);

/*******************************************************************************
*
* ipike_policy_select_ipsec_sa_param - select IPSec SA parameters for IKE v1
*
* This routine selects IPSec SA parameters for IKE v1 from an
* 'ipike_config_ipsec_sa' configuration structure. It selects the first
* acceptable transforms in the first acceptable proposal in the configuration
* structure for the IPSec SA. The routine sets a selected proposal and selected
* transforms for 'inbound_sa' and 'outbound_sa' structures.
*
* Parameters:
* \is
* \i <conf>
* A pointer to an 'ipike_config_ipsec_sa' structure for the IPSec SA
* configuration used to negotiate the IPSec SAs.
* \i <inbound_sa>
* A pointer to an 'ipike_sa' structure for the IPSec SA that is to be used for
* incoming traffic.
* \i <outbound_sa>
* A pointer to an 'ipike_sa' structure for the IPSec SA that is to be used for
* outgoing traffic.
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_GLOBAL Ipike_error ipike_policy_select_ipsec_sa_param
(
    Ipike_config_ipsec_sa* conf,
    Ipike_sa*              inbound_sa,
    Ipike_sa*              outbound_sa
);

#ifdef IPIKE_USE_VERSION2

/*******************************************************************************
*
* ipike2_policy_select_sa_param - select IKE and IPSec SA parameters for IKE v2
*
* This routine selects IKE and IPSec SA parameters for IKE v2 from an array of
* 'Ipike_config_proposal' structures. It selects the first acceptable transforms
* in the first acceptable proposal from the array of proposal configuration
* structures and updates an 'ipike_selected' structure with the selected
* parameters.
*
* Parameters:
* \is
* \i <is_ike>
* A boolean value, TRUE if an IKE SA is to be selected.
* \i <iproposals>
* A pointer to an array of 'Ipike_config_proposal' structures for the SA that is
* being negotiated.
* \i <sa>
* A pointer to an 'ipike2_sa' structure containing the IKE SA that is to be
* accepted or rejected.
* \i <selected>
* A pointer to an 'ipike_selected' structure. When the routine returns, the
* structure is updated with the selected parameters.
*
* \ie
*
* RETURNS: 'IPIKE_SUCCESS', or an error listed in the file 'ipike.h'.
*
* ERRNO:
*/
IP_GLOBAL Ipike_error ipike2_policy_select_sa_param
(
    Ip_bool                 is_ike,
    Ipike_config_proposal** proposals,
    Ipike2_sa*              sa,
    Ipike_selected*         selected
);

#endif /* IPIKE_USE_VERSION2 */

/*
 *===========================================================================
 *                    ipike_policy_accept_id
 *===========================================================================
 * Description: Accept/reject the peer identifier.
 * Parameters:  value - the configuration value for the IKE SA.
 *              id_type - the payload id type
 *              id_data - the payload id data
 *              cert - the peer certificate that may be accepted or
 *              rejected.
 * Returns:     IPIKE_SUCCESS
 *              IPIKE_ISAKMP_NO_PROPOSAL_CHOSEN
 */
IP_GLOBAL Ipike_error ipike_policy_accept_id
(
    const char*  value,
    Ip_u8        id_type,
    Ipike_value* id_data,
    X509*        cert
);

/*
 *===========================================================================
 *           ipike_policy_delete_phase1_on_phase2_failure
 *===========================================================================
 * Description: Get the current policy for how to handle phase2 failures
 * Parameters: -
 * Returns:     0 - Don't delete IKE SA (Phase1)
 *              1 - Delete IKE SA
 *
 */
IP_GLOBAL int
ipike_policy_delete_phase1_on_phase2_failure(void);

#ifdef IPIKE_USE_ROHC
/*
 *===========================================================================
 *                    ipike_policy_rohc_select
 *===========================================================================
 * Description: Initializes the ROHC object and selects a integrity
 *              algorithms that both end-points accept.
 * Parameters:  rohc     - ROHC parameters
 *              rohc_cfg - ROHC configuration
 * Returns:     IPIKE_SUCCESS
 *              IPIKE_OUT_OF_MEMORY
 */
IP_GLOBAL void
ipike_policy_rohc_select(
    Ipike_rohc *       rohc,
    Ipike_config_rohc * rohc_cfg);

#endif /* IPIKE_USE_ROHC */

#ifdef __cplusplus
}
#endif

#endif

/*
 ****************************************************************************
 *                      END OF FILE
 ****************************************************************************
 */