ipsec-tools/racoon/isakmp_cfg.h

   1 /*      $NetBSD: isakmp_cfg.h,v 1.6 2006/09/09 16:22:09 manu Exp $      */
   2
   3 /*      $KAME$ */
   4
   5 /*
   6  * Copyright (C) 2004 Emmanuel Dreyfus
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. Neither the name of the project nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #ifdef HAVE_LIBPAM
  35 #include <security/pam_appl.h>
  36 #endif
  37 #include <resolv.h>
  38
  39 /*
  40  * XXX don't forget to update
  41  * src/racoon/handler.c:exclude_cfg_addr()
  42  * if you add IPv6 capability
  43  */
  44
  45 /* Attribute types */
  46 #define INTERNAL_IP4_ADDRESS        1
  47 #define INTERNAL_IP4_NETMASK        2
  48 #define INTERNAL_IP4_DNS            3
  49 #define INTERNAL_IP4_NBNS           4
  50 #define INTERNAL_ADDRESS_EXPIRY     5
  51 #define INTERNAL_IP4_DHCP           6
  52 #define APPLICATION_VERSION         7
  53 #define INTERNAL_IP6_ADDRESS        8
  54 #define INTERNAL_IP6_NETMASK        9
  55 #define INTERNAL_IP6_DNS           10
  56 #define INTERNAL_IP6_NBNS          11
  57 #define INTERNAL_IP6_DHCP          12
  58 #define INTERNAL_IP4_SUBNET        13
  59 #define SUPPORTED_ATTRIBUTES       14
  60 #define INTERNAL_IP6_SUBNET        15
  61
  62 /* For APPLICATION_VERSION */
  63 #define ISAKMP_CFG_RACOON_VERSION "racoon / IPsec-tools"
  64
  65 /* For the wins servers -- XXX find the value somewhere ? */
  66 #define MAXWINS 4
  67
  68 /*
  69  * Global configuration for ISAKMP mode confiration address allocation
  70  * Read from the mode_cfg section of racoon.conf
  71  */
  72 struct isakmp_cfg_port {
  73         char    used;
  74 #ifdef HAVE_LIBPAM
  75         pam_handle_t *pam;
  76 #endif
  77 };
  78
  79 struct isakmp_cfg_config {
  80         in_addr_t               network4;
  81         in_addr_t               netmask4;
  82         in_addr_t               dns4[MAXNS];
  83         int                     dns4_index;
  84         in_addr_t               nbns4[MAXWINS];
  85         int                     nbns4_index;
  86         struct isakmp_cfg_port  *port_pool;
  87         int                     authsource;
  88         int                     groupsource;
  89         char                    **grouplist;
  90         int                     groupcount;
  91         int                     confsource;
  92         int                     accounting;
  93         size_t                  pool_size;
  94         int                     auth_throttle;
  95         /* XXX move this to a unity specific sub-structure */
  96         char                    default_domain[MAXPATHLEN + 1];
  97         char                    motd[MAXPATHLEN + 1];
  98         struct unity_netentry   *splitnet_list;
  99         int                     splitnet_count;
 100         int                     splitnet_type;
 101         char                    *splitdns_list;
 102         int                     splitdns_len;
 103         int                     pfs_group;
 104         int                     save_passwd;
 105 };
 106
 107 /* For utmp updating */
 108 #define TERMSPEC        "vpn%d"
 109
 110 /* For authsource */
 111 #define ISAKMP_CFG_AUTH_SYSTEM  0
 112 #define ISAKMP_CFG_AUTH_RADIUS  1
 113 #define ISAKMP_CFG_AUTH_PAM     2
 114 #define ISAKMP_CFG_AUTH_LDAP    4
 115
 116 /* For groupsource */
 117 #define ISAKMP_CFG_GROUP_SYSTEM 0
 118 #define ISAKMP_CFG_GROUP_LDAP   1
 119
 120 /* For confsource */
 121 #define ISAKMP_CFG_CONF_LOCAL   0
 122 #define ISAKMP_CFG_CONF_RADIUS  1
 123 #define ISAKMP_CFG_CONF_LDAP    2
 124
 125 /* For accounting */
 126 #define ISAKMP_CFG_ACCT_NONE    0
 127 #define ISAKMP_CFG_ACCT_RADIUS  1
 128 #define ISAKMP_CFG_ACCT_PAM     2
 129 #define ISAKMP_CFG_ACCT_LDAP    3
 130 #define ISAKMP_CFG_ACCT_SYSTEM  4
 131
 132 /* For pool_size */
 133 #define ISAKMP_CFG_MAX_CNX      255
 134
 135 /* For motd */
 136 #define ISAKMP_CFG_MOTD "/etc/motd"
 137
 138 /* For default domain */
 139 #define ISAKMP_CFG_DEFAULT_DOMAIN ""
 140
 141 extern struct isakmp_cfg_config isakmp_cfg_config;
 142
 143 /*
 144  * ISAKMP mode config state
 145  */
 146 #define LOGINLEN 31
 147 struct isakmp_cfg_state {
 148         int flags;                      /* See below */
 149         unsigned int port;              /* address index */
 150         char login[LOGINLEN + 1];       /* login */
 151         struct in_addr addr4;           /* IPv4 address */
 152         struct in_addr mask4;           /* IPv4 netmask */
 153         struct in_addr dns4[MAXNS];     /* IPv4 DNS (when client only) */
 154         int dns4_index;                 /* Number of IPv4 DNS (client only) */
 155         struct in_addr wins4[MAXWINS];  /* IPv4 WINS (when client only) */
 156         int wins4_index;                /* Number of IPv4 WINS (client only) */
 157         char default_domain[MAXPATHLEN + 1];    /* Default domain recieved */
 158         struct unity_netentry
 159             *split_include;             /* UNITY_SPLIT_INCLUDE */
 160         int include_count;              /* Number of SPLIT_INCLUDES */
 161         struct unity_netentry
 162             *split_local;               /* UNITY_LOCAL_LAN */
 163         int local_count;                /* Number of SPLIT_LOCAL */
 164         struct xauth_state xauth;       /* Xauth state, if revelant */
 165         struct isakmp_ivm *ivm;         /* XXX Use iph1's ivm? */
 166         u_int32_t last_msgid;           /* Last message-ID */
 167         vchar_t *attr_list;                     /* list of mode config attributes - used when started by api */
 168 };
 169
 170 /* flags */
 171 #define ISAKMP_CFG_VENDORID_XAUTH       0x01    /* Supports Xauth */
 172 #define ISAKMP_CFG_VENDORID_UNITY       0x02    /* Cisco Unity compliant */
 173 #define ISAKMP_CFG_PORT_ALLOCATED       0x04    /* Port allocated */
 174 #define ISAKMP_CFG_ADDR4_EXTERN         0x08    /* Address from external config  */
 175 #define ISAKMP_CFG_MASK4_EXTERN         0x10    /* Netmask from external config */
 176 #define ISAKMP_CFG_ADDR4_LOCAL          0x20    /* Address from local pool */
 177 #define ISAKMP_CFG_MASK4_LOCAL          0x40    /* Netmask from local pool */
 178 #define ISAKMP_CFG_GOT_ADDR4            0x80    /* Client got address */
 179 #define ISAKMP_CFG_GOT_MASK4            0x100   /* Client got mask */
 180 #define ISAKMP_CFG_GOT_DNS4             0x200   /* Client got DNS */
 181 #define ISAKMP_CFG_GOT_WINS4            0x400   /* Client got WINS */
 182 #define ISAKMP_CFG_DELETE_PH1           0x800   /* phase 1 should be deleted */
 183 #define ISAKMP_CFG_GOT_DEFAULT_DOMAIN   0x1000  /* Client got default domain */
 184 #define ISAKMP_CFG_GOT_SPLIT_INCLUDE    0x2000  /* Client got a split network config */
 185 #define ISAKMP_CFG_GOT_SPLIT_LOCAL      0x4000  /* Client got a split LAN config */
 186 #define ISAKMP_CFG_GOT_REPLY            0x8000  /* got config data from reply - don't process again */
 187
 188 struct isakmp_pl_attr;
 189 struct ph1handle;
 190 struct isakmp_ivm;
 191 void isakmp_cfg_r(struct ph1handle *, vchar_t *);
 192 int isakmp_cfg_attr_r(struct ph1handle *, u_int32_t, struct isakmp_pl_attr *, vchar_t *);
 193 int isakmp_cfg_reply(struct ph1handle *, struct isakmp_pl_attr *);
 194 int isakmp_cfg_request(struct ph1handle *, struct isakmp_pl_attr *, vchar_t *);
 195 int isakmp_cfg_set(struct ph1handle *, struct isakmp_pl_attr *, vchar_t *);
 196 int isakmp_cfg_send(struct ph1handle *, vchar_t *, u_int32_t, int, int, int, vchar_t *);
 197 struct isakmp_ivm *isakmp_cfg_newiv(struct ph1handle *, u_int32_t);
 198 void isakmp_cfg_rmstate(struct ph1handle *);
 199 struct isakmp_cfg_state *isakmp_cfg_mkstate(void);
 200 vchar_t *isakmp_cfg_copy(struct ph1handle *, struct isakmp_data *);
 201 vchar_t *isakmp_cfg_short(struct ph1handle *, struct isakmp_data *, int);
 202 vchar_t *isakmp_cfg_varlen(struct ph1handle *, struct isakmp_data *, char *, size_t);
 203 vchar_t *isakmp_cfg_string(struct ph1handle *, struct isakmp_data *, char *);
 204 int isakmp_cfg_getconfig(struct ph1handle *);
 205 int isakmp_cfg_setenv(struct ph1handle *, char ***, int *);
 206
 207 int isakmp_cfg_resize_pool(int);
 208 int isakmp_cfg_getport(struct ph1handle *);
 209 int isakmp_cfg_putport(struct ph1handle *, unsigned int);
 210 int isakmp_cfg_init(int);
 211 #define ISAKMP_CFG_INIT_COLD    1
 212 #define ISAKMP_CFG_INIT_WARM    0
 213
 214 #ifdef HAVE_LIBRADIUS
 215 struct rad_handle;
 216 extern struct rad_handle *radius_acct_state;
 217 int isakmp_cfg_radius_common(struct rad_handle *, int);
 218 #endif
 219
 220 #ifdef HAVE_LIBPAM
 221 int isakmp_cfg_accounting_pam(int, int);
 222 void cleanup_pam(int);
 223 #endif
 224
 225 int isakmp_cfg_accounting_system(int, struct sockaddr *, char *, int);