func (ipsec *IPSec) InitSARemote(msgInitSARemote []byte, localPeer, remotePeer mesh.PeerName, connUID uint64, localIP, remoteIP net.IP, udpPort int, sessionKey *[32]byte) error {
	// ID of outbound SPI
	spiID := getSPIId(localPeer, remotePeer, connUID)

	msg, err := deserializeMsgInitSARemote(msgInitSARemote)
	if err != nil {
		return errors.Wrap(err, "deserialize InitSARemote")
	}
	spi := msg.spi

	ipsec.Lock()
	defer ipsec.Unlock()

	ipsec.log.Infof("ipsec: InitSARemote: %s -> %s :%d 0x%x", localIP, remoteIP, udpPort, spi)

	// Derive SA key by using the received nonce
	key, err := deriveKey(sessionKey[:], msg.nonce, remotePeer)
	if err != nil {
		return errors.Wrap(err, "derive key")
	}

	// Create SA
	if sa, err := xfrmState(localIP, remoteIP, spi, true, key); err == nil {
		if err := netlink.XfrmStateAdd(sa); err != nil {
			return errors.Wrap(err, fmt.Sprintf("xfrm state update (out, %s, %s, 0x%x)", sa.Src, sa.Dst, sa.Spi))
		}
	} else {
		return errors.Wrap(err, "new xfrm state (out)")
	}

	// Create or update SP
	sp := xfrmPolicy(localIP, remoteIP, spi)
	if err := netlink.XfrmPolicyUpdate(sp); err != nil {
		return errors.Wrap(err, fmt.Sprintf("xfrm policy update (%s, %s, 0x%x)", localIP, remoteIP, spi))
	}

	si := spiInfo{spi: spi, isDirOut: true}
	ipsec.spiInfo[spiID] = si
	ipsec.spis[spi] = &si

	return nil
}
// InitSARemote initializes outbound ipsec to remotePeer.
// Triggered by remotePeer.
InitSARemote initializes outbound ipsec to remotePeer.
Triggered by remotePeer.
// InitSARemote initializes outbound ipsec to remotePeer . // Triggered by remotePeer .
func (ipsec *IPSec) InitSARemote(msgInitSARemote []byte, localPeer, remotePeer mesh.PeerName, connUID uint64, localIP, remoteIP net.IP, udpPort int, sessionKey *[32]byte) error {
	spiID := getSPIId(localPeer, remotePeer, connUID)
	msg, err := deserializeMsgInitSARemote(msgInitSARemote)
	if err != nil {
		return errors.Wrap(err, "deserialize InitSARemote")
	}
	spi := msg.spi
	ipsec.Lock()
	defer ipsec.Unlock()
	ipsec.log.Infof("ipsec: InitSARemote: %s -> %s :%d 0x%x", localIP, remoteIP, udpPort, spi)
	key, err := deriveKey(sessionKey[:], msg.nonce, remotePeer)
	if err != nil {
		return errors.Wrap(err, "derive key")
	}
	if sa, err := xfrmState(localIP, remoteIP, spi, true, key); err == nil {
		if err := netlink.XfrmStateAdd(sa); err != nil {
			return errors.Wrap(err, fmt.Sprintf("xfrm state update (out, %s, %s, 0x%x)", sa.Src, sa.Dst, sa.Spi))
		}
	} else {
		return errors.Wrap(err, "new xfrm state (out)")
	}
	sp := xfrmPolicy(localIP, remoteIP, spi)
	if err := netlink.XfrmPolicyUpdate(sp); err != nil {
		return errors.Wrap(err, fmt.Sprintf("xfrm policy update (%s, %s, 0x%x)", localIP, remoteIP, spi))
	}
	si := spiInfo{spi: spi, isDirOut: true}
	ipsec.spiInfo[spiID] = si
	ipsec.spis[spi] = &si
	return nil
}
func ( ipsec * IPSec ) InitSARemote ( msgInitSARemote [ ] byte , localPeer , remotePeer mesh . PeerName , connUID uint64 , localIP , remoteIP net . IP , udpPort int , sessionKey * [ 32 ] byte ) error { spiID := getSPIId ( localPeer , remotePeer , connUID ) msg , err := deserializeMsgInitSARemote ( msgInitSARemote ) if err != nil { return errors . Wrap ( err , " " ) } spi := msg . spi ipsec . Lock ( ) defer ipsec . Unlock ( ) ipsec . log . Infof ( " " , localIP , remoteIP , udpPort , spi ) key , err := deriveKey ( sessionKey [ : ] , msg . nonce , remotePeer ) if err != nil { return errors . Wrap ( err , " " ) } if sa , err := xfrmState ( localIP , remoteIP , spi , true , key ) ; err == nil { if err := netlink . XfrmStateAdd ( sa ) ; err != nil { return errors . Wrap ( err , fmt . Sprintf ( " " , sa . Src , sa . Dst , sa . Spi ) ) } } else { return errors . Wrap ( err , " " ) } sp := xfrmPolicy ( localIP , remoteIP , spi ) if err := netlink . XfrmPolicyUpdate ( sp ) ; err != nil { return errors . Wrap ( err , fmt . Sprintf ( " " , localIP , remoteIP , spi ) ) } si := spiInfo { spi : spi , isDirOut : true } ipsec . spiInfo [ spiID ] = si ipsec . spis [ spi ] = & si return nil }
InitSARemote initializes outbound ipsec to remotePeer.
InitSARemote initializes outbound ipsec to remotePeer .
// ID of outbound SPI // Derive SA key by using the received nonce // Create SA // Create or update SP