Annotation of embedaddon/strongswan/src/libcharon/config/peer_cfg.h, revision 1.1.1.1
1.1 misho 1: /*
2: * Copyright (C) 2007-2019 Tobias Brunner
3: * Copyright (C) 2005-2009 Martin Willi
4: * Copyright (C) 2005 Jan Hutter
5: * HSR Hochschule fuer Technik Rapperswil
6: *
7: * This program is free software; you can redistribute it and/or modify it
8: * under the terms of the GNU General Public License as published by the
9: * Free Software Foundation; either version 2 of the License, or (at your
10: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11: *
12: * This program is distributed in the hope that it will be useful, but
13: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15: * for more details.
16: */
17:
18: /**
19: * @defgroup peer_cfg peer_cfg
20: * @{ @ingroup config
21: */
22:
23: #ifndef PEER_CFG_H_
24: #define PEER_CFG_H_
25:
26: typedef enum cert_policy_t cert_policy_t;
27: typedef enum unique_policy_t unique_policy_t;
28: typedef struct peer_cfg_t peer_cfg_t;
29: typedef struct peer_cfg_create_t peer_cfg_create_t;
30:
31: #include <library.h>
32: #include <utils/identification.h>
33: #include <collections/enumerator.h>
34: #include <selectors/traffic_selector.h>
35: #include <crypto/proposal/proposal.h>
36: #include <config/ike_cfg.h>
37: #include <config/child_cfg.h>
38: #include <credentials/auth_cfg.h>
39:
40: /**
41: * Certificate sending policy. This is also used for certificate
42: * requests when using this definition for the other peer. If
43: * it is CERT_NEVER_SEND, a certreq is omitted, otherwise its
44: * included.
45: *
46: * @warning These definitions must be the same as in pluto/starter,
47: * as they are sent over the stroke socket.
48: */
49: enum cert_policy_t {
50: /** always send certificates, even when not requested */
51: CERT_ALWAYS_SEND = 0,
52: /** send certificate upon cert request */
53: CERT_SEND_IF_ASKED = 1,
54: /** never send a certificate, even when requested */
55: CERT_NEVER_SEND = 2,
56: };
57:
58: /**
59: * enum strings for cert_policy_t
60: */
61: extern enum_name_t *cert_policy_names;
62:
63: /**
64: * Uniqueness of an IKE_SA, used to drop multiple connections with one peer.
65: */
66: enum unique_policy_t {
67: /** never check for client uniqueness */
68: UNIQUE_NEVER,
69: /** only check for client uniqueness when receiving an INITIAL_CONTACT */
70: UNIQUE_NO,
71: /** replace existing IKE_SAs when new ones get established by a client */
72: UNIQUE_REPLACE,
73: /** keep existing IKE_SAs, close the new ones on connection attempt */
74: UNIQUE_KEEP,
75: };
76:
77: /**
78: * enum strings for unique_policy_t
79: */
80: extern enum_name_t *unique_policy_names;
81:
82: /**
83: * Configuration of a peer, specified by IDs.
84: *
85: * The peer config defines a connection between two given IDs. It contains
86: * exactly one ike_cfg_t, which is used for initiation. Additionally, it
87: * contains multiple child_cfg_t defining which CHILD_SAs are allowed for this
88: * peer.
89: * @verbatim
90: +-------------------+ +---------------+
91: +---------------+ | peer_cfg | +---------------+ |
92: | ike_cfg | +-------------------+ | child_cfg | |
93: +---------------+ | - ids | +---------------+ |
94: | - hosts | 1 1 | - cas | 1 n | - proposals | |
95: | - proposals |<-----| - auth info |----->| - traffic sel | |
96: | - ... | | - dpd config | | - ... |-+
97: +---------------+ | - ... | +---------------+
98: +-------------------+
99: | 1 0 |
100: | |
101: v n n V
102: +-------------------+ +-------------------+
103: +-------------------+ | +-------------------+ |
104: | auth_cfg | | | auth_cfg | |
105: +-------------------+ | +-------------------+ |
106: | - local rules |-+ | - remote constr. |-+
107: +-------------------+ +-------------------+
108: @endverbatim
109: *
110: * Each peer_cfg has two lists of authentication config attached. Local
111: * authentication configs define how to authenticate ourself against the remote
112: * peer. Each config is enforced using the multiple authentication extension
113: * (RFC4739).
114: * The remote authentication configs are handled as constraints. The peer has
115: * to fulfill each of these rules (using multiple authentication, in any order)
116: * to gain access to the configuration.
117: */
118: struct peer_cfg_t {
119:
120: /**
121: * Get the name of the peer_cfg.
122: *
123: * Returned object is not getting cloned.
124: *
125: * @return peer_cfg's name
126: */
127: char* (*get_name) (peer_cfg_t *this);
128:
129: /**
130: * Get the IKE version to use for initiating.
131: *
132: * @return IKE major version
133: */
134: ike_version_t (*get_ike_version)(peer_cfg_t *this);
135:
136: /**
137: * Get the IKE config to use for initiation.
138: *
139: * @return the IKE config to use
140: */
141: ike_cfg_t* (*get_ike_cfg) (peer_cfg_t *this);
142:
143: /**
144: * Attach a CHILD config.
145: *
146: * @param child_cfg CHILD config to add
147: */
148: void (*add_child_cfg) (peer_cfg_t *this, child_cfg_t *child_cfg);
149:
150: /**
151: * Detach a CHILD config, pointed to by an enumerator.
152: *
153: * @param enumerator enumerator indicating element position
154: */
155: void (*remove_child_cfg)(peer_cfg_t *this, enumerator_t *enumerator);
156:
157: /**
158: * Replace the CHILD configs with those in the given PEER config.
159: *
160: * The enumerator enumerates the removed and added CHILD configs
161: * (child_cfg_t*, bool), where the flag is FALSE for removed configs and
162: * TRUE for added configs. Configs that are equal are not enumerated.
163: *
164: * @param other other config to get CHILD configs from
165: * @return an enumerator over removed/added CHILD configs
166: */
167: enumerator_t* (*replace_child_cfgs)(peer_cfg_t *this, peer_cfg_t *other);
168:
169: /**
170: * Create an enumerator for all attached CHILD configs.
171: *
172: * @return an enumerator over all CHILD configs.
173: */
174: enumerator_t* (*create_child_cfg_enumerator) (peer_cfg_t *this);
175:
176: /**
177: * Select a CHILD config from traffic selectors.
178: *
179: * @param my_ts TS for local side
180: * @param other_ts TS for remote side
181: * @param my_hosts hosts to narrow down dynamic TS for local side
182: * @param other_hosts hosts to narrow down dynamic TS for remote side
183: * @return selected CHILD config, or NULL if no match found
184: */
185: child_cfg_t* (*select_child_cfg) (peer_cfg_t *this,
186: linked_list_t *my_ts, linked_list_t *other_ts,
187: linked_list_t *my_hosts, linked_list_t *other_hosts);
188:
189: /**
190: * Add an authentication config to the peer configuration.
191: *
192: * @param cfg config to add
193: * @param local TRUE for local rules, FALSE for remote constraints
194: */
195: void (*add_auth_cfg)(peer_cfg_t *this, auth_cfg_t *cfg, bool local);
196:
197: /**
198: * Create an enumerator over registered authentication configs.
199: *
200: * @param local TRUE for local rules, FALSE for remote constraints
201: * @return enumerator over auth_cfg_t*
202: */
203: enumerator_t* (*create_auth_cfg_enumerator)(peer_cfg_t *this, bool local);
204:
205: /**
206: * Should a certificate be sent for this connection?
207: *
208: * @return certificate sending policy
209: */
210: cert_policy_t (*get_cert_policy) (peer_cfg_t *this);
211:
212: /**
213: * How to handle uniqueness of IKE_SAs?
214: *
215: * @return unique policy
216: */
217: unique_policy_t (*get_unique_policy) (peer_cfg_t *this);
218:
219: /**
220: * Get the max number of retries after timeout.
221: *
222: * @return max number retries
223: */
224: uint32_t (*get_keyingtries) (peer_cfg_t *this);
225:
226: /**
227: * Get a time to start rekeying.
228: *
229: * @param jitter subtract a jitter value to randomize time
230: * @return time in s when to start rekeying, 0 disables rekeying
231: */
232: uint32_t (*get_rekey_time)(peer_cfg_t *this, bool jitter);
233:
234: /**
235: * Get a time to start reauthentication.
236: *
237: * @param jitter subtract a jitter value to randomize time
238: * @return time in s when to start reauthentication, 0 disables it
239: */
240: uint32_t (*get_reauth_time)(peer_cfg_t *this, bool jitter);
241:
242: /**
243: * Get the timeout of a rekeying/reauthenticating SA.
244: *
245: * @return timeout in s
246: */
247: uint32_t (*get_over_time)(peer_cfg_t *this);
248:
249: /**
250: * Use MOBIKE (RFC4555) if peer supports it?
251: *
252: * @return TRUE to enable MOBIKE support
253: */
254: bool (*use_mobike) (peer_cfg_t *this);
255:
256: /**
257: * Use/Accept aggressive mode with IKEv1?.
258: *
259: * @return TRUE to use aggressive mode
260: */
261: bool (*use_aggressive)(peer_cfg_t *this);
262:
263: /**
264: * Use pull or push mode for mode config?
265: *
266: * @return TRUE to use pull, FALSE to use push mode
267: */
268: bool (*use_pull_mode)(peer_cfg_t *this);
269:
270: /**
271: * Get the DPD check interval.
272: *
273: * @return dpd_delay in seconds
274: */
275: uint32_t (*get_dpd) (peer_cfg_t *this);
276:
277: /**
278: * Get the DPD timeout interval (IKEv1 only)
279: *
280: * @return dpd_timeout in seconds
281: */
282: uint32_t (*get_dpd_timeout) (peer_cfg_t *this);
283:
284: /**
285: * Add a virtual IP to request as initiator.
286: *
287: * @param vip virtual IP to request, may be %any or %any6
288: */
289: void (*add_virtual_ip)(peer_cfg_t *this, host_t *vip);
290:
291: /**
292: * Create an enumerator over virtual IPs to request.
293: *
294: * The returned enumerator enumerates over IPs added with add_virtual_ip().
295: *
296: * @return enumerator over host_t*
297: */
298: enumerator_t* (*create_virtual_ip_enumerator)(peer_cfg_t *this);
299:
300: /**
301: * Add a pool name this configuration uses to select virtual IPs.
302: *
303: * @param name pool name to use for virtual IP lookup
304: */
305: void (*add_pool)(peer_cfg_t *this, char *name);
306:
307: /**
308: * Create an enumerator over pool names of this config.
309: *
310: * @return enumerator over char*
311: */
312: enumerator_t* (*create_pool_enumerator)(peer_cfg_t *this);
313:
314: /**
315: * Optional interface ID to set on policies/SAs.
316: *
317: * @param inbound TRUE for inbound, FALSE for outbound
318: * @return interface ID
319: */
320: uint32_t (*get_if_id)(peer_cfg_t *this, bool inbound);
321:
322: /**
323: * Get the PPK ID to use with this peer.
324: *
325: * @return PPK id
326: */
327: identification_t *(*get_ppk_id)(peer_cfg_t *this);
328:
329: /**
330: * Whether a PPK is required with this peer.
331: *
332: * @return TRUE, if a PPK is required
333: */
334: bool (*ppk_required)(peer_cfg_t *this);
335:
336: #ifdef ME
337: /**
338: * Is this a mediation connection?
339: *
340: * @return TRUE, if this is a mediation connection
341: */
342: bool (*is_mediation)(peer_cfg_t *this);
343:
344: /**
345: * Get name of the connection this one is mediated through.
346: *
347: * @return the name of the mediation connection
348: */
349: char* (*get_mediated_by)(peer_cfg_t *this);
350:
351: /**
352: * Get the id of the other peer at the mediation server.
353: *
354: * This is the leftid of the peer's connection with the mediation server.
355: *
356: * If it is not configured, it is assumed to be the same as the right id
357: * of this connection.
358: *
359: * @return the id of the other peer
360: */
361: identification_t* (*get_peer_id)(peer_cfg_t *this);
362: #endif /* ME */
363:
364: /**
365: * Check if two peer configurations are equal.
366: *
367: * This method does not compare associated ike/child_cfg.
368: *
369: * @param other candidate to check for equality against this
370: * @return TRUE if peer_cfg and ike_cfg are equal
371: */
372: bool (*equals)(peer_cfg_t *this, peer_cfg_t *other);
373:
374: /**
375: * Increase reference count.
376: *
377: * @return reference to this
378: */
379: peer_cfg_t* (*get_ref) (peer_cfg_t *this);
380:
381: /**
382: * Destroys the peer_cfg object.
383: *
384: * Decrements the internal reference counter and
385: * destroys the peer_cfg when it reaches zero.
386: */
387: void (*destroy) (peer_cfg_t *this);
388: };
389:
390: /**
391: * Data passed to the constructor of a peer_cfg_t object.
392: */
393: struct peer_cfg_create_t {
394: /** Whether to send a certificate payload */
395: cert_policy_t cert_policy;
396: /** Uniqueness of an IKE_SA */
397: unique_policy_t unique;
398: /** How many keying tries should be done before giving up */
399: uint32_t keyingtries;
400: /** Timeout in seconds before starting rekeying */
401: uint32_t rekey_time;
402: /** Timeout in seconds before starting reauthentication */
403: uint32_t reauth_time;
404: /** Time range in seconds to randomly subtract from rekey/reauth time */
405: uint32_t jitter_time;
406: /** Maximum overtime in seconds before closing a rekeying/reauth SA */
407: uint32_t over_time;
408: /** Disable MOBIKE (RFC4555) */
409: bool no_mobike;
410: /** Use/accept aggressive mode with IKEv1 */
411: bool aggressive;
412: /** TRUE to use modeconfig push, FALSE for pull */
413: bool push_mode;
414: /** DPD check interval, 0 to disable */
415: uint32_t dpd;
416: /** DPD timeout interval (IKEv1 only), if 0 default applies */
417: uint32_t dpd_timeout;
418: /** Optional inbound interface ID */
419: uint32_t if_id_in;
420: /** Optional outbound interface ID */
421: uint32_t if_id_out;
422: /** Postquantum Preshared Key ID (adopted) */
423: identification_t *ppk_id;
424: /** TRUE if a PPK is required, FALSE if it's optional */
425: bool ppk_required;
426: #ifdef ME
427: /** TRUE if this is a mediation connection */
428: bool mediation;
429: /** peer_cfg_t of the mediation connection to mediate through (cloned) */
430: char *mediated_by;
431: /** ID that identifies our peer at the mediation server (adopted) */
432: identification_t *peer_id;
433: #endif /* ME */
434: };
435:
436: /**
437: * Create a configuration object for IKE_AUTH and later.
438: *
439: * @param name name of the peer_cfg (cloned)
440: * @param ike_cfg IKE config to use when acting as initiator (adopted)
441: * @param data data for this peer_cfg
442: * @return peer_cfg_t object
443: */
444: peer_cfg_t *peer_cfg_create(char *name, ike_cfg_t *ike_cfg,
445: peer_cfg_create_t *data);
446:
447: #endif /** PEER_CFG_H_ @}*/
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to peer_cfg.h CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / config