ipsec_db.h File Reference

IPsec Security Policy Database (SPD) + Security Association Database (SAD) - RFC 4301. More...

#include "protocore_config.h"

Go to the source code of this file.

Detailed Description

IPsec Security Policy Database (SPD) + Security Association Database (SAD) - RFC 4301.

The ESP datapath (esp.h) is the crypto transform; this file is the two databases that decide, for a given packet, WHETHER and WITH WHICH SA to apply it. Both are pure, host-testable data structures with no heap and no lwIP dependency - the remaining device-side piece is only the IP input/output hook that feeds packets through these lookups.

• SPD (RFC 4301 §4.4.1): an ordered list of policies matched against a packet's selectors (source / destination address ranges, protocol, port ranges); the FIRST matching policy wins and names an action - PROTECT (apply ESP with a bound SA), BYPASS (send in the clear), or DISCARD (drop).
• SAD (RFC 4301 §4.4.2): the active Security Associations keyed by SPI. An inbound ESP packet is demuxed to its SA by SPI; an outbound PROTECT policy names the SA to encapsulate with. Each SA carries its key / salt, its outbound sequence counter, and its inbound anti-replay window.

Selectors are value types (addresses stored inline, big-endian) so the databases persist independently of any wire buffer. pc_ipsec_selector_from_ts bridges an IKEv2-negotiated TSi/TSr pair (the traffic selectors carried in ikev2.h) into an SPD selector, per RFC 4301 §4.4.1.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file ipsec_db.h.