[apple/ipsec.git] / ipsec-tools / racoon / remoteconf.h

/*	$NetBSD: remoteconf.h,v 1.7 2006/10/03 08:01:56 vanhu Exp $	*/

/* Id: remoteconf.h,v 1.26 2006/05/06 15:52:44 manubsd Exp */

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#ifndef _REMOTECONF_H
#define _REMOTECONF_H

/* remote configuration */

#include <sys/queue.h>
#include "genlist.h"
#ifdef ENABLE_HYBRID
#include "isakmp_var.h"
#include "isakmp_xauth.h"
#endif
#include <CoreFoundation/CFData.h>
#include "algorithm.h"


struct proposalspec {
	time_t lifetime;		/* for isakmp/ipsec */
	int lifebyte;			/* for isakmp/ipsec */
	struct secprotospec *spspec;	/* the head is always current spec. */
	struct proposalspec *next;	/* the tail is the most prefered. */
	struct proposalspec *prev;
};

struct secprotospec {
	int prop_no;
	int trns_no;
	int strength;		/* for isakmp/ipsec */
	int encklen;		/* for isakmp/ipsec */
	time_t lifetime;	/* for isakmp */
	int lifebyte;		/* for isakmp */
	int proto_id;		/* for ipsec (isakmp?) */
	int ipsec_level;	/* for ipsec */
	int encmode;		/* for ipsec */
	int vendorid;		/* for isakmp */
	char *gssid;
	struct sockaddr_storage *remote;
	int algclass[MAXALGCLASS];

	struct secprotospec *next;	/* the tail is the most prefiered. */
	struct secprotospec *prev;
	struct proposalspec *back;
};


struct etypes {
	int type;
	struct etypes *next;
};

enum {
    DPD_ALGO_DEFAULT = 0,
    DPD_ALGO_INBOUND_DETECT,
    DPD_ALGO_BLACKHOLE_DETECT,
    DPD_ALGO_MAX,
};


struct remoteconf {
	struct sockaddr_storage *remote;	/* remote IP address */
    int remote_prefix;                  /* allows subnet for remote address */
					/* if family is AF_UNSPEC, that is
					 * for anonymous configuration. */

	struct etypes *etypes;		/* exchange type list. the head
					 * is a type to be sent first. */
	int doitype;			/* doi type */
	int sittype;			/* situation type */

	int idvtype;			/* my identifier type */
	vchar_t *idv;			/* my identifier */
	vchar_t *key;			/* my pre-shared key */
	struct genlist *idvl_p;         /* peer's identifiers list */

	int	identity_in_keychain;	/* cert and private key is in the keychain */
	vchar_t *keychainCertRef;	/* peristant keychain ref for cert */
	int secrettype;			/* type of secret [use, key, keychain] */
	vchar_t *shared_secret;	/* shared secret */
	vchar_t *open_dir_auth_group;	/* group to be used to authorize user */

	int certtype;			/* certificate type if need */
	int getcert_method;		/* the way to get peer's certificate */
	int cacerttype;			/* CA type is needed */
	int send_cert;			/* send to CERT or not */
	int send_cr;			/* send to CR or not */
	int verify_cert;		/* verify a CERT strictly */
	int cert_verification;	/* openssl or security framework */
	int cert_verification_option;	/* nothing, peers identifier, or open_dir */
	int verify_identifier;		/* vefify the peer's identifier */
	int nonce_size;			/* the number of bytes of nonce */
	int passive;			/* never initiate */
	int ike_frag;			/* IKE fragmentation */
	int esp_frag;			/* ESP fragmentation */
	int mode_cfg;			/* Gets config through mode config */
	int support_proxy;		/* support mip6/proxy */
#define GENERATE_POLICY_NONE   0
#define GENERATE_POLICY_REQUIRE        1
#define GENERATE_POLICY_UNIQUE 2
	int gen_policy;			/* generate policy if no policy found */
	int ini_contact;		/* initial contact */
	int pcheck_level;		/* level of propocl checking */
	int nat_traversal;		/* NAT-Traversal */
	int natt_multiple_user; /* special handling of multiple users behind a nat - for VPN server */
	int natt_keepalive;		/* do we need to send natt keep alive */
	int dh_group;			/* use it when only aggressive mode */
	struct dhgroup *dhgrp;		/* use it when only aggressive mode */
					/* above two can't be defined by user*/

	int retry_counter;		/* times to retry. */
	int retry_interval;		/* interval each retry. */
				/* above 2 values are copied from localconf. */

	int dpd;				/* Negociate DPD support ? */
	int dpd_retry;			/* in seconds */
	int dpd_interval;		/* in seconds */
	int dpd_maxfails;
    int dpd_algo;
    int idle_timeout;       /* in seconds */
    int idle_timeout_dir;   /* direction to check */
	
	int ph1id; /* ph1id to be matched with sainfo sections */

	int weak_phase1_check;		/* act on unencrypted deletions ? */

	struct isakmpsa *proposal;	/* proposal list */
	struct remoteconf *inherited_from;	/* the original rmconf 
						   from which this one 
						   was inherited */
	struct proposalspec *prhead;

#ifdef ENABLE_HYBRID
	struct xauth_rmconf *xauth;
#endif
    int initiate_ph1rekey;
    int in_list;            // in the linked list
    int refcount;           // ref count - in use
    int ike_version;
    
    struct sockaddr_storage *forced_local;	/* forced local IP address */

	TAILQ_ENTRY(remoteconf) chain;	/* next remote conf */
};

struct dhgroup;

/* ISAKMP SA specification */
struct isakmpsa {
	int version;
	int prop_no;
	int trns_no;
	time_t lifetime;
	time_t lifetimegap;
	size_t lifebyte;
	int enctype;
	int encklen;
	int authmethod;
	int hashtype;
	int vendorid;
	int dh_group;				/* don't use it if aggressive mode */
	struct dhgroup *dhgrp;		/* don't use it if aggressive mode */
	int             prf;
	int             prfklen;

	struct isakmpsa *next;		/* next transform */
	struct remoteconf *rmconf;	/* backpointer to remoteconf */
};

struct idspec {
	int idtype;                     /* identifier type */
	vchar_t *id;                    /* identifier */
};

typedef struct remoteconf *(rmconf_func_t) (struct remoteconf *rmconf, void *data);

extern struct remoteconf *getrmconf (struct sockaddr_storage *);
extern struct remoteconf *getrmconf_strict
	(struct sockaddr_storage *remote, int allow_anon);

extern int no_remote_configs (int);
extern struct remoteconf *copyrmconf (struct sockaddr_storage *);
extern struct remoteconf *create_rmconf (void);
extern void retain_rmconf(struct remoteconf *);
extern void release_rmconf(struct remoteconf *);
extern struct remoteconf *duprmconf (struct remoteconf *);
extern void delrmconf (struct remoteconf *);
extern void delisakmpsa (struct isakmpsa *);
extern void deletypes (struct etypes *);
extern struct etypes * dupetypes (struct etypes *);
extern void insrmconf (struct remoteconf *);
extern void remrmconf (struct remoteconf *);
extern void flushrmconf (void);
extern void initrmconf (void);
extern struct etypes *check_etypeok
	(struct remoteconf *, u_int8_t);
extern struct remoteconf *foreachrmconf (rmconf_func_t rmconf_func,
					     void *data);

extern struct isakmpsa *newisakmpsa (void);
extern struct isakmpsa *dupisakmpsa (struct isakmpsa *);

extern void insisakmpsa (struct isakmpsa *, struct remoteconf *);

extern void dumprmconf (void);

extern struct idspec *newidspec (void);

#endif /* _REMOTECONF_H */
Commit	Line	Data
d1e348cf A	1	/* $NetBSD: remoteconf.h,v 1.7 2006/10/03 08:01:56 vanhu Exp $ */
	2
	3	/* Id: remoteconf.h,v 1.26 2006/05/06 15:52:44 manubsd Exp */
52b7d2ce A	4
	5	/*
	6	* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
	7	* All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in the
	16	* documentation and/or other materials provided with the distribution.
	17	* 3. Neither the name of the project nor the names of its contributors
	18	* may be used to endorse or promote products derived from this software
	19	* without specific prior written permission.
	20	*
	21	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	22	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	23	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	24	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	25	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	26	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	27	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	28	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	29	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	30	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	31	* SUCH DAMAGE.
	32	*/
	33
	34	#ifndef _REMOTECONF_H
	35	#define _REMOTECONF_H
	36
	37	/* remote configuration */
	38
	39	#include <sys/queue.h>
	40	#include "genlist.h"
d1e348cf A	41	#ifdef ENABLE_HYBRID
	42	#include "isakmp_var.h"
	43	#include "isakmp_xauth.h"
	44	#endif
52b7d2ce	45	#include <CoreFoundation/CFData.h>
52b7d2ce A	46	#include "algorithm.h"
52b7d2ce A	47
d1e348cf	48
65c25746	49
52b7d2ce A	50	struct proposalspec {
	51	time_t lifetime; /* for isakmp/ipsec */
	52	int lifebyte; /* for isakmp/ipsec */
	53	struct secprotospec spspec; / the head is always current spec. */
	54	struct proposalspec next; / the tail is the most prefered. */
	55	struct proposalspec *prev;
	56	};
	57
	58	struct secprotospec {
	59	int prop_no;
	60	int trns_no;
	61	int strength; /* for isakmp/ipsec */
	62	int encklen; /* for isakmp/ipsec */
	63	time_t lifetime; /* for isakmp */
	64	int lifebyte; /* for isakmp */
	65	int proto_id; /* for ipsec (isakmp?) */
	66	int ipsec_level; /* for ipsec */
	67	int encmode; /* for ipsec */
	68	int vendorid; /* for isakmp */
	69	char *gssid;
85f41bec	70	struct sockaddr_storage *remote;
52b7d2ce A	71	int algclass[MAXALGCLASS];
	72
	73	struct secprotospec next; / the tail is the most prefiered. */
	74	struct secprotospec *prev;
	75	struct proposalspec *back;
	76	};
	77
	78
	79	struct etypes {
	80	int type;
	81	struct etypes *next;
	82	};
	83
d1e348cf A	84	enum {
	85	DPD_ALGO_DEFAULT = 0,
	86	DPD_ALGO_INBOUND_DETECT,
	87	DPD_ALGO_BLACKHOLE_DETECT,
	88	DPD_ALGO_MAX,
	89	};
	90
52b7d2ce A	91
52b7d2ce A	92	struct remoteconf {
85f41bec A	93	struct sockaddr_storage remote; / remote IP address */
85f41bec A	94	int remote_prefix; /* allows subnet for remote address */
52b7d2ce A	95	/* if family is AF_UNSPEC, that is
	96	* for anonymous configuration. */
	97
	98	struct etypes etypes; / exchange type list. the head
	99	* is a type to be sent first. */
	100	int doitype; /* doi type */
	101	int sittype; /* situation type */
	102
	103	int idvtype; /* my identifier type */
	104	vchar_t idv; / my identifier */
	105	vchar_t key; / my pre-shared key */
	106	struct genlist idvl_p; / peer's identifiers list */
	107
52b7d2ce A	108	int identity_in_keychain; /* cert and private key is in the keychain */
	109	vchar_t keychainCertRef; / peristant keychain ref for cert */
	110	int secrettype; /* type of secret [use, key, keychain] */
	111	vchar_t shared_secret; / shared secret */
	112	vchar_t open_dir_auth_group; / group to be used to authorize user */
52b7d2ce A	113
52b7d2ce A	114	int certtype; /* certificate type if need */
52b7d2ce A	115	int getcert_method; /* the way to get peer's certificate */
52b7d2ce A	116	int cacerttype; /* CA type is needed */
52b7d2ce A	117	int send_cert; /* send to CERT or not */
	118	int send_cr; /* send to CR or not */
	119	int verify_cert; /* verify a CERT strictly */
52b7d2ce A	120	int cert_verification; /* openssl or security framework */
52b7d2ce A	121	int cert_verification_option; /* nothing, peers identifier, or open_dir */
52b7d2ce A	122	int verify_identifier; /* vefify the peer's identifier */
	123	int nonce_size; /* the number of bytes of nonce */
	124	int passive; /* never initiate */
	125	int ike_frag; /* IKE fragmentation */
	126	int esp_frag; /* ESP fragmentation */
	127	int mode_cfg; /* Gets config through mode config */
	128	int support_proxy; /* support mip6/proxy */
d1e348cf A	129	#define GENERATE_POLICY_NONE 0
	130	#define GENERATE_POLICY_REQUIRE 1
	131	#define GENERATE_POLICY_UNIQUE 2
52b7d2ce A	132	int gen_policy; /* generate policy if no policy found */
	133	int ini_contact; /* initial contact */
	134	int pcheck_level; /* level of propocl checking */
	135	int nat_traversal; /* NAT-Traversal */
52b7d2ce	136	int natt_multiple_user; /* special handling of multiple users behind a nat - for VPN server */
d1e348cf	137	int natt_keepalive; /* do we need to send natt keep alive */
52b7d2ce A	138	int dh_group; /* use it when only aggressive mode */
	139	struct dhgroup dhgrp; / use it when only aggressive mode */
	140	/* above two can't be defined by user*/
	141
	142	int retry_counter; /* times to retry. */
	143	int retry_interval; /* interval each retry. */
	144	/* above 2 values are copied from localconf. */
	145
	146	int dpd; /* Negociate DPD support ? */
	147	int dpd_retry; /* in seconds */
	148	int dpd_interval; /* in seconds */
d1e348cf A	149	int dpd_maxfails;
	150	int dpd_algo;
	151	int idle_timeout; /* in seconds */
	152	int idle_timeout_dir; /* direction to check */
	153
	154	int ph1id; /* ph1id to be matched with sainfo sections */
	155
	156	int weak_phase1_check; /* act on unencrypted deletions ? */
52b7d2ce A	157
	158	struct isakmpsa proposal; / proposal list */
	159	struct remoteconf inherited_from; / the original rmconf
	160	from which this one
	161	was inherited */
	162	struct proposalspec *prhead;
d1e348cf A	163
	164	#ifdef ENABLE_HYBRID
	165	struct xauth_rmconf *xauth;
	166	#endif
65c25746 A	167	int initiate_ph1rekey;
	168	int in_list; // in the linked list
	169	int refcount; // ref count - in use
	170	int ike_version;
d9c572c0 A	171
d9c572c0 A	172	struct sockaddr_storage forced_local; / forced local IP address */
d1e348cf	173
52b7d2ce A	174	TAILQ_ENTRY(remoteconf) chain; /* next remote conf */
	175	};
	176
	177	struct dhgroup;
	178
	179	/* ISAKMP SA specification */
	180	struct isakmpsa {
65c25746	181	int version;
52b7d2ce A	182	int prop_no;
	183	int trns_no;
	184	time_t lifetime;
65c25746	185	time_t lifetimegap;
52b7d2ce A	186	size_t lifebyte;
	187	int enctype;
	188	int encklen;
	189	int authmethod;
	190	int hashtype;
	191	int vendorid;
65c25746	192	int dh_group; /* don't use it if aggressive mode */
52b7d2ce	193	struct dhgroup dhgrp; / don't use it if aggressive mode */
65c25746 A	194	int prf;
65c25746 A	195	int prfklen;
52b7d2ce A	196
	197	struct isakmpsa next; / next transform */
	198	struct remoteconf rmconf; / backpointer to remoteconf */
	199	};
	200
	201	struct idspec {
	202	int idtype; /* identifier type */
	203	vchar_t id; / identifier */
	204	};
	205
65c25746	206	typedef struct remoteconf (rmconf_func_t) (struct remoteconf rmconf, void *data);
52b7d2ce	207
65c25746	208	extern struct remoteconf getrmconf (struct sockaddr_storage );
52b7d2ce	209	extern struct remoteconf *getrmconf_strict
65c25746 A	210	(struct sockaddr_storage *remote, int allow_anon);
	211
	212	extern int no_remote_configs (int);
	213	extern struct remoteconf copyrmconf (struct sockaddr_storage );
	214	extern struct remoteconf *create_rmconf (void);
	215	extern void retain_rmconf(struct remoteconf *);
	216	extern void release_rmconf(struct remoteconf *);
	217	extern struct remoteconf duprmconf (struct remoteconf );
	218	extern void delrmconf (struct remoteconf *);
	219	extern void delisakmpsa (struct isakmpsa *);
	220	extern void deletypes (struct etypes *);
	221	extern struct etypes * dupetypes (struct etypes *);
	222	extern void insrmconf (struct remoteconf *);
	223	extern void remrmconf (struct remoteconf *);
	224	extern void flushrmconf (void);
	225	extern void initrmconf (void);
52b7d2ce	226	extern struct etypes *check_etypeok
65c25746 A	227	(struct remoteconf *, u_int8_t);
	228	extern struct remoteconf *foreachrmconf (rmconf_func_t rmconf_func,
	229	void *data);
52b7d2ce	230
65c25746 A	231	extern struct isakmpsa *newisakmpsa (void);
65c25746 A	232	extern struct isakmpsa dupisakmpsa (struct isakmpsa );
52b7d2ce	233
65c25746	234	extern void insisakmpsa (struct isakmpsa , struct remoteconf );
52b7d2ce	235
65c25746	236	extern void dumprmconf (void);
52b7d2ce	237
65c25746	238	extern struct idspec *newidspec (void);
52b7d2ce A	239
52b7d2ce A	240	#endif /* _REMOTECONF_H */