|
|
|
The OID_TCP_TASK_IPSEC_ADD_SA OID is set by the transport protocol to request that a miniport driver add one or more security associations (SAs) to its NIC.
The information for each SA is formatted as an OFFLOAD_IPSEC_ADD_SA structure, which is defined as follows:
typedef struct _OFFLOAD_IPSEC_ADD_SA {
IPAddr SrcAddr;
IPMask SrcMask;
IPAddr DestAddr;
IPMask DestMask;
ULONG Protocol;
USHORT SrcPort;
USHORT DestPort;
IPAddr SrcTunnelAddr;
IPAddr DestTunnelAddr;
USHORT Flags;
SHORT NumSAs;
OFFLOAD_SECURITY_ASSOCIATION SecAssoc[OFFLOAD_MAX_SAS];
NDIS_HANDLE OffloadHandle;
ULONG KeyLen;
UCHAR KeyMat[1];
} OFFLOAD_IPSEC_ADD_SA, *POFFLOAD_IPSEC_ADD_SA;
The members of this structure contain the following information:
The TCP/IP transport specifies one or two OFFLOAD_SECURITY_ASSOCIATION structures in the buffer at SecAssoc. Each OFFLOAD_SECURITY_ASSOCIATION structure indicates the type of operation—authentication or encryption/decryption— for which the SA specified in the structure is to be used. The order of the OFFLOAD_SECURITY_ASSOCIATION structures in the array indicates the order in which the miniport driver should perform the operations for each SA. Only one combination of operations is supported: encryption/decryption (ESP) followed by authentication (AH).
The length of each key in the buffer at KeyMat is specified by algoKeyLen in the OFFLOAD_ALGO_INFO structure that specifies the confidentiality or integrity algorithm. (An OFFLOAD_ALGO_INFO structure is a member of an OFFLOAD_SECURITY_ASSOCIATION structure.)
The first seven members of the OFFLOAD_IPSEC_ADD_SA structure (SrcAddr, SrcMask, DestAddr, DestMask, Protocol, SrcPort, and DestPort) constitute a filter that specifies the source and destination, as well as the IP protocol(s), to which the SA(s) apply. This filter pertains to a transport-mode connection—that is, an end-to-end connection between two hosts. If the specified connection is made through a tunnel, the source and destination addresses of the tunnel are specified by SrcTunnelAddr and DestTunnelAddr, respectively.
If a filter parameter is set to zero, that parameter is not used to filter packets for the specified SA(s). For example, if SrcAddr is set to zero, the specified SA(s) can apply to a packet that contains any source address. To take this to the extreme, if all the filter parameters are set to zero, the specified SA(s) apply to any source host sending any type of packet to any destination host.
The TCP/IP transport can specify an IP protocol in the Protocol member to indicate that the specified SA(s) apply only to packets of the specified protocol type. If Protocol is set to zero, the specified SA(s) apply to all packets sent from the specified source to the specified destination.
An OFFLOAD_SECURITY_ASSOCIATION structure specifies a single security association (SA). The OFFLOAD_SECURITY_ASSOCIATION structure is an element in the SecAssoc variable-length array. SecAssoc contains one or two OFFLOAD_SECURITY_ASSOCIATION structures.
The OFFLOAD_SECURITY_ASSOCIATION structure is defined as follows:
typedef struct _OFFLOAD_SECURITY_ASSOCIATION {
OFFLOAD_OPERATION_E Operation;
SPI_TYPE SPI;
OFFLOAD_ALGO_INFO IntegrityAlgo;
OFFLOAD_ALGO_INFO ConfAlgo;
OFFLOAD_ALGO_INFO Reserved;
} OFFLOAD_SECURITY_ASSOCIATION, *POFFLOAD_SECURITY_ASSOCIATION;
The members of the OFFLOAD_SECURITY_ASSOCIATION structure contain the following information:
An SA specified for use in processing authentication headers (AH) will have an operation type of AUTHENTICATE and will have an IntegrityAlgo (integrity algorithm). The SA will not have an a ConfAlgo (confidentiality algorithm). In this case, ConfAlgo will contain zeros.
An SA specified for use in processing encapsulating security payloads (ESPs) will have an operation type of ENCRYPT and may have an IntegrityAlgo (integrity algorithm) and/or a ConfAlgo (confidentiality algorithm).
The OFFLOAD_ALGO_INFO structure, which is a member of an OFFLOAD_SECURITY_ASSOCIATION structure, specifies an algorithm used for a security association (SA).
The OFFLOAD_ALGO_INFO structure is defined as follows:
typedef struct _OFFLOAD_ALGO_INFO {
ULONG algoIdentifier;
ULONG algoKeylen;
ULONG Reserved;
} OFFLOAD_ALGO_INFO, *POFFLOAD_ALGO_INFO;
The members of an OFFLOAD_ALGO_INFO structure contain the following information:
If the algorithm is a confidentiality algorithm (that is, if the OFFLOAD_ALGO_INFO structure is specifying a ConfAlgo), algoIdentifier can be any of the following values:
If the algorithm is an integrity algorithm (that is, if the OFFLOAD_ALGO_INFO structure is specifying an IntegrityAlgo), algoIdentifier can be either of the following values:
If only an integrity algorithm (IntegrityAlgo) is specified in the OFFLOAD_SECURITY_ASSOCIATION structure, algoKeylen indicates the length of the key for the integrity algorithm, starting from the beginning of the buffer at KeyMat.
If both an integrity and a confidentiality algorithm (IntegrityAlgo and ConfAlgo) are specified, algoKeylen for the integrity algorithm indicates the length of the key for the integrity algorithm, starting from the beginning of the buffer at KeyMat. The algoKeylen for the confidentiality algorithm, in this case, indicates the length of the key for the confidentiality algorithm, starting the from the end of the key for the integrity algorithm.