Annotation of embedaddon/strongswan/src/libcharon/config/ike_cfg.h, revision 1.1.1.1
1.1 misho 1: /*
2: * Copyright (C) 2012-2019 Tobias Brunner
3: * Copyright (C) 2005-2007 Martin Willi
4: * Copyright (C) 2005 Jan Hutter
5: * HSR Hochschule fuer Technik Rapperswil
6: *
7: * This program is free software; you can redistribute it and/or modify it
8: * under the terms of the GNU General Public License as published by the
9: * Free Software Foundation; either version 2 of the License, or (at your
10: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11: *
12: * This program is distributed in the hope that it will be useful, but
13: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15: * for more details.
16: */
17:
18: /**
19: * @defgroup ike_cfg ike_cfg
20: * @{ @ingroup config
21: */
22:
23: #ifndef IKE_CFG_H_
24: #define IKE_CFG_H_
25:
26: typedef enum ike_version_t ike_version_t;
27: typedef enum fragmentation_t fragmentation_t;
28: typedef enum childless_t childless_t;
29: typedef struct ike_cfg_t ike_cfg_t;
30: typedef struct ike_cfg_create_t ike_cfg_create_t;
31:
32: #include <library.h>
33: #include <networking/host.h>
34: #include <collections/linked_list.h>
35: #include <utils/identification.h>
36: #include <crypto/proposal/proposal.h>
37: #include <crypto/diffie_hellman.h>
38:
39: /**
40: * IKE version.
41: */
42: enum ike_version_t {
43: /** any version */
44: IKE_ANY = 0,
45: /** IKE version 1 */
46: IKEV1 = 1,
47: /** IKE version 2 */
48: IKEV2 = 2,
49: };
50:
51: /**
52: * Proprietary IKEv1 fragmentation and IKEv2 fragmentation
53: */
54: enum fragmentation_t {
55: /** disable fragmentation */
56: FRAGMENTATION_NO,
57: /** announce support, but don't send any fragments */
58: FRAGMENTATION_ACCEPT,
59: /** enable fragmentation, if supported by peer */
60: FRAGMENTATION_YES,
61: /** force use of fragmentation (even for the first message for IKEv1) */
62: FRAGMENTATION_FORCE,
63: };
64:
65: /**
66: * Childless IKE_SAs (RFC 6023)
67: */
68: enum childless_t {
69: /** Allow childless IKE_SAs as responder, but initiate regular IKE_SAs */
70: CHILDLESS_ALLOW,
71: /** Don't accept childless IKE_SAs as responder, don't initiate them */
72: CHILDLESS_NEVER,
73: /** Only accept the creation of childless IKE_SAs (also as responder) */
74: CHILDLESS_FORCE,
75: };
76:
77: /**
78: * enum strings for ike_version_t
79: */
80: extern enum_name_t *ike_version_names;
81:
82: /**
83: * An ike_cfg_t defines the rules to set up an IKE_SA.
84: *
85: * @see peer_cfg_t to get an overview over the configurations.
86: */
87: struct ike_cfg_t {
88:
89: /**
90: * Get the IKE version to use with this configuration.
91: *
92: * @return IKE major version
93: */
94: ike_version_t (*get_version)(ike_cfg_t *this);
95:
96: /**
97: * Resolve the local address to use for initiation.
98: *
99: * @param family address family to prefer, or AF_UNSPEC
100: * @return resolved host, NULL on error
101: */
102: host_t* (*resolve_me)(ike_cfg_t *this, int family);
103:
104: /**
105: * Resolve the remote address to use for initiation.
106: *
107: * @param family address family to prefer, or AF_UNSPEC
108: * @return resolved host, NULL on error
109: */
110: host_t* (*resolve_other)(ike_cfg_t *this, int family);
111:
112: /**
113: * Check how good a host matches to the configured local address.
114: *
115: * @param host host to check match quality
116: * @return quality of the match, 0 if not matching at all
117: */
118: u_int (*match_me)(ike_cfg_t *this, host_t *host);
119:
120: /**
121: * Check how good a host matches to the configured remote address.
122: *
123: * @param host host to check match quality
124: * @return quality of the match, 0 if not matching at all
125: */
126: u_int (*match_other)(ike_cfg_t *this, host_t *host);
127:
128: /**
129: * Get own address.
130: *
131: * @return string of address/DNS name
132: */
133: char* (*get_my_addr) (ike_cfg_t *this);
134:
135: /**
136: * Get peer's address.
137: *
138: * @return string of address/DNS name
139: */
140: char* (*get_other_addr) (ike_cfg_t *this);
141:
142: /**
143: * Get the port to use as our source port.
144: *
145: * @return source address port, host order
146: */
147: uint16_t (*get_my_port)(ike_cfg_t *this);
148:
149: /**
150: * Get the port to use as destination port.
151: *
152: * @return destination address, host order
153: */
154: uint16_t (*get_other_port)(ike_cfg_t *this);
155:
156: /**
157: * Get the DSCP value to use for IKE packets send from connections.
158: *
159: * @return DSCP value
160: */
161: uint8_t (*get_dscp)(ike_cfg_t *this);
162:
163: /**
164: * Adds a proposal to the list.
165: *
166: * The first added proposal has the highest priority, the last
167: * added the lowest. It is safe to add NULL as proposal, which has no
168: * effect.
169: *
170: * @param proposal proposal to add, or NULL
171: */
172: void (*add_proposal) (ike_cfg_t *this, proposal_t *proposal);
173:
174: /**
175: * Returns a list of all supported proposals.
176: *
177: * Returned list and its proposals must be destroyed after use.
178: *
179: * @return list containing all the proposals
180: */
181: linked_list_t* (*get_proposals) (ike_cfg_t *this);
182:
183: /**
184: * Select a proposal from a list of supplied proposals.
185: *
186: * Returned proposal must be destroyed after use.
187: *
188: * @param proposals list of proposals to select from
189: * @param flags flags to consider during proposal selection
190: * @return selected proposal, or NULL if none matches.
191: */
192: proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals,
193: proposal_selection_flag_t flags);
194:
195: /**
196: * Check if the config has a matching proposal.
197: *
198: * @param match proposal to check
199: * @param private accept algorithms from a private range
200: * @return TRUE if a matching proposal is contained
201: */
202: bool(*has_proposal)(ike_cfg_t *this, proposal_t *match, bool private);
203:
204: /**
205: * Should we send a certificate request in IKE_SA_INIT?
206: *
207: * @return certificate request sending policy
208: */
209: bool (*send_certreq) (ike_cfg_t *this);
210:
211: /**
212: * Enforce UDP encapsulation by faking NATD notifies?
213: *
214: * @return TRUE to enforce UDP encapsulation
215: */
216: bool (*force_encap) (ike_cfg_t *this);
217:
218: /**
219: * Use IKE fragmentation
220: *
221: * @return TRUE to use fragmentation
222: */
223: fragmentation_t (*fragmentation) (ike_cfg_t *this);
224:
225: /**
226: * Whether to initiate/accept childless IKE_SAs
227: *
228: * @return initiate/accept childless IKE_SAs
229: */
230: childless_t (*childless)(ike_cfg_t *this);
231:
232: /**
233: * Get the DH group to use for IKE_SA setup.
234: *
235: * @return dh group to use for initialization
236: */
237: diffie_hellman_group_t (*get_dh_group)(ike_cfg_t *this);
238:
239: /**
240: * Check if two IKE configs are equal.
241: *
242: * @param other other to check for equality
243: * @return TRUE if other equal to this
244: */
245: bool (*equals)(ike_cfg_t *this, ike_cfg_t *other);
246:
247: /**
248: * Increase reference count.
249: *
250: * @return reference to this
251: */
252: ike_cfg_t* (*get_ref) (ike_cfg_t *this);
253:
254: /**
255: * Destroys a ike_cfg_t object.
256: *
257: * Decrements the internal reference counter and
258: * destroys the ike_cfg when it reaches zero.
259: */
260: void (*destroy) (ike_cfg_t *this);
261: };
262:
263: /**
264: * Data passed to the constructor of an ike_cfg_t object.
265: *
266: * local and remote are comma separated lists of IP addresses, DNS names,
267: * IP ranges or subnets. When initiating, the first non-range/subnet address is
268: * used as address. When responding, a match is performed against all items in
269: * the list.
270: */
271: struct ike_cfg_create_t {
272: /** IKE major version to use for this config */
273: ike_version_t version;
274: /** Address/DNS name of local peer (cloned) */
275: char *local;
276: /** IKE port to use as source, 500 uses IKEv2 port floating */
277: uint16_t local_port;
278: /** Address/DNS name of remote peer (cloned) */
279: char *remote;
280: /** IKE port to use as dest, 500 uses IKEv2 port floating */
281: uint16_t remote_port;
282: /** TRUE to not send any certificate requests */
283: bool no_certreq;
284: /** Enforce UDP encapsulation by faking NATD notify */
285: bool force_encap;
286: /** Use IKE fragmentation */
287: fragmentation_t fragmentation;
288: /** Childless IKE_SA configuration */
289: childless_t childless;
290: /** DSCP value to send IKE packets with */
291: uint8_t dscp;
292: };
293:
294: /**
295: * Creates an ike_cfg_t object.
296: *
297: * @param data data for this ike_cfg
298: * @return ike_cfg_t object.
299: */
300: ike_cfg_t *ike_cfg_create(ike_cfg_create_t *data);
301:
302: /**
303: * Determine the address family of the local or remote address(es). If multiple
304: * families are configured AF_UNSPEC is returned. %any is ignored (%any4|6 are
305: * not though).
306: *
307: * @param this ike config to check
308: * @param local TRUE to check local addresses, FALSE for remote
309: * @return address family of address(es) if distinct
310: */
311: int ike_cfg_get_family(ike_cfg_t *this, bool local);
312:
313: /**
314: * Determine if the given address was explicitly configured as local or remote
315: * address.
316: *
317: * @param this ike config to check
318: * @param addr address to check
319: * @param local TRUE to check local addresses, FALSE for remote
320: * @return TRUE if address was configured
321: */
322: bool ike_cfg_has_address(ike_cfg_t *this, host_t *addr, bool local);
323:
324: #endif /** IKE_CFG_H_ @}*/
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to ike_cfg.h CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / config