1 /* $NetBSD: remoteconf.h,v 1.16 2011/03/14 15:50:36 vanhu Exp $ */ 2 3 /* Id: remoteconf.h,v 1.26 2006/05/06 15:52:44 manubsd Exp */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #ifndef _REMOTECONF_H 35 #define _REMOTECONF_H 36 37 /* remote configuration */ 38 39 #include <sys/queue.h> 40 #include "genlist.h" 41 #ifdef ENABLE_HYBRID 42 #include "isakmp_var.h" 43 #include "isakmp_xauth.h" 44 #endif 45 46 struct ph1handle; 47 struct secprotospec; 48 49 struct etypes { 50 int type; 51 struct etypes *next; 52 }; 53 54 /* ISAKMP SA specification */ 55 struct isakmpsa { 56 int prop_no; 57 int trns_no; 58 time_t lifetime; 59 size_t lifebyte; 60 int enctype; 61 int encklen; 62 int authmethod; 63 int hashtype; 64 int vendorid; 65 #ifdef HAVE_GSSAPI 66 vchar_t *gssid; 67 #endif 68 int dh_group; /* don't use it if aggressive mode */ 69 struct dhgroup *dhgrp; /* don't use it if aggressive mode */ 70 71 struct isakmpsa *next; /* next transform */ 72 }; 73 74 /* Certificate information */ 75 struct rmconf_cert { 76 vchar_t *data; /* certificate payload */ 77 char *filename; /* name of local file */ 78 }; 79 80 /* Script hooks */ 81 #define SCRIPT_PHASE1_UP 0 82 #define SCRIPT_PHASE1_DOWN 1 83 #define SCRIPT_PHASE1_DEAD 2 84 #define SCRIPT_MAX 2 85 extern char *script_names[SCRIPT_MAX + 1]; 86 87 struct remoteconf { 88 char *name; /* remote configuration name */ 89 struct sockaddr *remote; /* remote IP address */ 90 /* if family is AF_UNSPEC, that is 91 * for anonymous configuration. */ 92 93 struct etypes *etypes; /* exchange type list. the head 94 * is a type to be sent first. */ 95 int doitype; /* doi type */ 96 int sittype; /* situation type */ 97 98 int idvtype; /* my identifier type */ 99 vchar_t *idv; /* my identifier */ 100 vchar_t *key; /* my pre-shared key */ 101 struct genlist *idvl_p; /* peer's identifiers list */ 102 103 char *myprivfile; /* file name of my private key file */ 104 char *mycertfile; /* file name of my certificate */ 105 vchar_t *mycert; /* my certificate */ 106 char *peerscertfile; /* file name of peer's certifcate */ 107 vchar_t *peerscert; /* peer's certificate */ 108 char *cacertfile; /* file name of CA */ 109 vchar_t *cacert; /* CA certificate */ 110 111 int send_cert; /* send to CERT or not */ 112 int send_cr; /* send to CR or not */ 113 int match_empty_cr; /* does this match if CR is empty */ 114 int verify_cert; /* verify a CERT strictly */ 115 int verify_identifier; /* vefify the peer's identifier */ 116 int nonce_size; /* the number of bytes of nonce */ 117 int passive; /* never initiate */ 118 int ike_frag; /* IKE fragmentation */ 119 int esp_frag; /* ESP fragmentation */ 120 int mode_cfg; /* Gets config through mode config */ 121 int support_proxy; /* support mip6/proxy */ 122 #define GENERATE_POLICY_NONE 0 123 #define GENERATE_POLICY_REQUIRE 1 124 #define GENERATE_POLICY_UNIQUE 2 125 int gen_policy; /* generate policy if no policy found */ 126 int ini_contact; /* initial contact */ 127 int pcheck_level; /* level of propocl checking */ 128 int nat_traversal; /* NAT-Traversal */ 129 vchar_t *script[SCRIPT_MAX + 1];/* script hooks paths */ 130 int dh_group; /* use it when only aggressive mode */ 131 struct dhgroup *dhgrp; /* use it when only aggressive mode */ 132 /* above two can't be defined by user*/ 133 134 int dpd; /* Negociate DPD support ? */ 135 int dpd_retry; /* in seconds */ 136 int dpd_interval; /* in seconds */ 137 int dpd_maxfails; 138 139 int rekey; /* rekey ph1 when active ph2s? */ 140 #define REKEY_OFF FALSE 141 #define REKEY_ON TRUE 142 #define REKEY_FORCE 2 143 144 uint32_t ph1id; /* ph1id to be matched with sainfo sections */ 145 146 int weak_phase1_check; /* act on unencrypted deletions ? */ 147 148 struct isakmpsa *proposal; /* proposal list */ 149 struct remoteconf *inherited_from; /* the original rmconf 150 from which this one 151 was inherited */ 152 153 time_t lifetime; /* for isakmp/ipsec */ 154 int lifebyte; /* for isakmp/ipsec */ 155 struct secprotospec *spspec; /* the head is always current spec. */ 156 157 struct genlist *rsa_private, /* lists of PlainRSA keys to use */ 158 *rsa_public; 159 160 #ifdef ENABLE_HYBRID 161 struct xauth_rmconf *xauth; 162 #endif 163 164 TAILQ_ENTRY(remoteconf) chain; /* next remote conf */ 165 }; 166 167 #define RMCONF_NONCE_SIZE(rmconf) \ 168 (rmconf != NULL ? rmconf->nonce_size : DEFAULT_NONCE_SIZE) 169 170 struct dhgroup; 171 172 struct idspec { 173 int idtype; /* identifier type */ 174 vchar_t *id; /* identifier */ 175 }; 176 177 struct rmconfselector { 178 int flags; 179 struct sockaddr *remote; 180 int etype; 181 struct isakmpsa *approval; 182 vchar_t *identity; 183 vchar_t *certificate_request; 184 }; 185 186 extern void rmconf_selector_from_ph1 __P((struct rmconfselector *rmsel, 187 struct ph1handle *iph1)); 188 extern int enumrmconf __P((struct rmconfselector *rmsel, 189 int (* enum_func)(struct remoteconf *rmconf, void *arg), 190 void *enum_arg)); 191 192 #define GETRMCONF_F_NO_ANONYMOUS 0x0001 193 #define GETRMCONF_F_NO_PASSIVE 0x0002 194 195 #define RMCONF_ERR_MULTIPLE ((struct remoteconf *) -1) 196 197 extern int rmconf_match_identity __P((struct remoteconf *rmconf, 198 vchar_t *id_p)); 199 extern struct remoteconf *getrmconf __P((struct sockaddr *remote, int flags)); 200 extern struct remoteconf *getrmconf_by_ph1 __P((struct ph1handle *iph1)); 201 extern struct remoteconf *getrmconf_by_name __P((const char *name)); 202 203 extern struct remoteconf *newrmconf __P((void)); 204 extern struct remoteconf *duprmconf_shallow __P((struct remoteconf *)); 205 extern int duprmconf_finish __P((struct remoteconf *)); 206 extern void delrmconf __P((struct remoteconf *)); 207 extern void deletypes __P((struct etypes *)); 208 extern struct etypes * dupetypes __P((struct etypes *)); 209 extern void insrmconf __P((struct remoteconf *)); 210 extern void remrmconf __P((struct remoteconf *)); 211 extern void flushrmconf __P((void)); 212 extern void dupspspec_list __P((struct remoteconf *, struct remoteconf *)); 213 extern void flushspspec __P((struct remoteconf *)); 214 extern void initrmconf __P((void)); 215 extern void rmconf_start_reload __P((void)); 216 extern void rmconf_finish_reload __P((void)); 217 218 extern int check_etypeok __P((struct remoteconf *, void *)); 219 220 extern struct isakmpsa *newisakmpsa __P((void)); 221 extern struct isakmpsa *dupisakmpsa __P((struct isakmpsa *)); 222 extern void delisakmpsa __P((struct isakmpsa *)); 223 extern void insisakmpsa __P((struct isakmpsa *, struct remoteconf *)); 224 #ifdef ENABLE_HYBRID 225 extern int isakmpsa_switch_authmethod __P((int authmethod)); 226 #else 227 static inline int isakmpsa_switch_authmethod(int authmethod) 228 { 229 return authmethod; 230 } 231 #endif 232 extern struct isakmpsa * checkisakmpsa __P((int pcheck, 233 struct isakmpsa *proposal, 234 struct isakmpsa *acceptable)); 235 236 237 extern void dumprmconf __P((void)); 238 239 extern struct idspec *newidspec __P((void)); 240 241 extern vchar_t *script_path_add __P((vchar_t *)); 242 243 #endif /* _REMOTECONF_H */ 244
