ipsec-tools/racoon/remoteconf.h

   1 /* $Id: remoteconf.h,v 1.19.2.1 2005/05/20 00:37:42 manubsd Exp $ */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #ifndef _REMOTECONF_H
  33 #define _REMOTECONF_H
  34
  35 /* remote configuration */
  36
  37 #include <sys/queue.h>
  38 #include "genlist.h"
  39 #ifdef __APPLE__
  40 #include <CoreFoundation/CFData.h>
  41 #endif
  42 #include "algorithm.h"
  43
  44 struct proposalspec {
  45         time_t lifetime;                /* for isakmp/ipsec */
  46         int lifebyte;                   /* for isakmp/ipsec */
  47         struct secprotospec *spspec;    /* the head is always current spec. */
  48         struct proposalspec *next;      /* the tail is the most prefered. */
  49         struct proposalspec *prev;
  50 };
  51
  52 struct secprotospec {
  53         int prop_no;
  54         int trns_no;
  55         int strength;           /* for isakmp/ipsec */
  56         int encklen;            /* for isakmp/ipsec */
  57         time_t lifetime;        /* for isakmp */
  58         int lifebyte;           /* for isakmp */
  59         int proto_id;           /* for ipsec (isakmp?) */
  60         int ipsec_level;        /* for ipsec */
  61         int encmode;            /* for ipsec */
  62         int vendorid;           /* for isakmp */
  63         char *gssid;
  64         struct sockaddr *remote;
  65         int algclass[MAXALGCLASS];
  66
  67         struct secprotospec *next;      /* the tail is the most prefiered. */
  68         struct secprotospec *prev;
  69         struct proposalspec *back;
  70 };
  71
  72
  73 struct etypes {
  74         int type;
  75         struct etypes *next;
  76 };
  77
  78 /* Script hooks */
  79 #define SCRIPT_PHASE1_UP        0
  80 #define SCRIPT_PHASE1_DOWN      1
  81 #define SCRIPT_MAX              1
  82 extern char *script_names[SCRIPT_MAX + 1];
  83 extern vchar_t *script_paths;
  84
  85 struct remoteconf {
  86         struct sockaddr *remote;        /* remote IP address */
  87                                         /* if family is AF_UNSPEC, that is
  88                                          * for anonymous configuration. */
  89
  90         struct etypes *etypes;          /* exchange type list. the head
  91                                          * is a type to be sent first. */
  92         int doitype;                    /* doi type */
  93         int sittype;                    /* situation type */
  94
  95         int idvtype;                    /* my identifier type */
  96         vchar_t *idv;                   /* my identifier */
  97         vchar_t *key;                   /* my pre-shared key */
  98         struct genlist *idvl_p;         /* peer's identifiers list */
  99
 100 #ifdef __APPLE__
 101         int     identity_in_keychain;   /* cert and private key is in the keychain */
 102         vchar_t *keychainCertRef;       /* peristant keychain ref for cert */
 103         int secrettype;                 /* type of secret [use, key, keychain] */
 104         vchar_t *shared_secret; /* shared secret */
 105         vchar_t *open_dir_auth_group;   /* group to be used to authorize user */
 106 #endif
 107
 108         int certtype;                   /* certificate type if need */
 109         char *mycertfile;               /* file name of my certificate */
 110         char *myprivfile;               /* file name of my private key file */
 111         char *peerscertfile;            /* file name of peer's certifcate */
 112         int getcert_method;             /* the way to get peer's certificate */
 113         int cacerttype;                 /* CA type is needed */
 114         char *cacertfile;               /* file name of CA */
 115         int getcacert_method;           /* the way to get the CA */
 116         int send_cert;                  /* send to CERT or not */
 117         int send_cr;                    /* send to CR or not */
 118         int verify_cert;                /* verify a CERT strictly */
 119 #ifdef __APPLE__
 120         int cert_verification;  /* openssl or security framework */
 121         int cert_verification_option;   /* nothing, peers identifier, or open_dir */
 122 #endif
 123         int verify_identifier;          /* vefify the peer's identifier */
 124         int nonce_size;                 /* the number of bytes of nonce */
 125         int passive;                    /* never initiate */
 126         int ike_frag;                   /* IKE fragmentation */
 127         int esp_frag;                   /* ESP fragmentation */
 128         int mode_cfg;                   /* Gets config through mode config */
 129         int support_proxy;              /* support mip6/proxy */
 130         int gen_policy;                 /* generate policy if no policy found */
 131         int ini_contact;                /* initial contact */
 132         int pcheck_level;               /* level of propocl checking */
 133         int nat_traversal;              /* NAT-Traversal */
 134 #ifdef __APPLE__
 135         int natt_multiple_user; /* special handling of multiple users behind a nat - for VPN server */
 136 #endif
 137         int script[SCRIPT_MAX + 1];     /* script hooks index in script_paths */
 138         int dh_group;                   /* use it when only aggressive mode */
 139         struct dhgroup *dhgrp;          /* use it when only aggressive mode */
 140                                         /* above two can't be defined by user*/
 141
 142         int retry_counter;              /* times to retry. */
 143         int retry_interval;             /* interval each retry. */
 144                                 /* above 2 values are copied from localconf. */
 145
 146         int dpd;                                /* Negociate DPD support ? */
 147         int dpd_retry;                  /* in seconds */
 148         int dpd_interval;               /* in seconds */
 149         int dpd_maxfails;
 150
 151         struct isakmpsa *proposal;      /* proposal list */
 152         struct remoteconf *inherited_from;      /* the original rmconf
 153                                                    from which this one
 154                                                    was inherited */
 155         struct proposalspec *prhead;
 156
 157         struct genlist  *rsa_private,   /* lists of PlainRSA keys to use */
 158                         *rsa_public;
 159         TAILQ_ENTRY(remoteconf) chain;  /* next remote conf */
 160 };
 161
 162 struct dhgroup;
 163
 164 /* ISAKMP SA specification */
 165 struct isakmpsa {
 166         int prop_no;
 167         int trns_no;
 168         time_t lifetime;
 169         size_t lifebyte;
 170         int enctype;
 171         int encklen;
 172         int authmethod;
 173         int hashtype;
 174         int vendorid;
 175 #ifdef HAVE_GSSAPI
 176         vchar_t *gssid;
 177 #endif
 178         int dh_group;                   /* don't use it if aggressive mode */
 179         struct dhgroup *dhgrp;          /* don't use it if aggressive mode */
 180
 181         struct isakmpsa *next;          /* next transform */
 182         struct remoteconf *rmconf;      /* backpointer to remoteconf */
 183 };
 184
 185 struct idspec {
 186         int idtype;                     /* identifier type */
 187         vchar_t *id;                    /* identifier */
 188 };
 189
 190 typedef struct remoteconf * (rmconf_func_t)(struct remoteconf *rmconf, void *data);
 191
 192 extern struct remoteconf *getrmconf __P((struct sockaddr *));
 193 extern struct remoteconf *getrmconf_strict
 194         __P((struct sockaddr *remote, int allow_anon));
 195 extern struct remoteconf *copyrmconf __P((struct sockaddr *));
 196 extern struct remoteconf *newrmconf __P((void));
 197 extern struct remoteconf *duprmconf __P((struct remoteconf *));
 198 extern void delrmconf __P((struct remoteconf *));
 199 extern void delisakmpsa __P((struct isakmpsa *));
 200 extern void deletypes __P((struct etypes *));
 201 extern struct etypes * dupetypes __P((struct etypes *));
 202 extern void insrmconf __P((struct remoteconf *));
 203 extern void remrmconf __P((struct remoteconf *));
 204 extern void flushrmconf __P((void));
 205 extern void initrmconf __P((void));
 206 extern struct etypes *check_etypeok
 207         __P((struct remoteconf *, u_int8_t));
 208 extern struct remoteconf *foreachrmconf __P((rmconf_func_t rmconf_func,
 209                                              void *data));
 210
 211 extern struct isakmpsa *newisakmpsa __P((void));
 212 extern struct isakmpsa *dupisakmpsa __P((struct isakmpsa *));
 213
 214 extern void insisakmpsa __P((struct isakmpsa *, struct remoteconf *));
 215
 216 extern void dumprmconf __P((void));
 217
 218 extern struct idspec *newidspec __P((void));
 219
 220 extern int script_path_add __P((vchar_t *));
 221
 222 extern void rsa_key_free __P((void *entry));
 223
 224 #endif /* _REMOTECONF_H */