bjayesh/m241Neelima
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

original files of m241

Browse Source
This commit is contained in:
neelimap
2026-07-30 11:19:44 +05:30
parent 170c2b3f3a
commit afc7070c1f
12254 changed files with 7655111 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/ip_net2-6.9/ipike/config/01ike.cdf
+308
View File
@@ -0,0 +1,308 @@
/* 01ike.cdf - IKE configuration file */
/*
* Copyright (c) 2006-2007 Wind River Systems, Inc.
*
* The right to copy, distribute or otherwise make use of this software
* may be licensed only pursuant to the terms of an applicable Wind River
* license agreement. No license to Wind River intellectual property rights
* is granted herein. All rights not licensed by Wind River are reserved
* by Wind River.
*/
/*
modification history
--------------------
01g,12may08,brg Removed IPIKE_ALLOW_DUPLICATE_SA. Its an internal
configuration variable.((WIND00108854))
01f,11oct07,jho Fixed bad IPIKE_NAT_PORT default value.
01e,19sep07,rme Added missing backslash
01d,07sep07,rme Replaced SELECTION_IPCOM_FS with SELECT_IPCOM_FS in INCLUDE_INTERNET_KEY_EXCHANGE
01c,06mar07,kch Added support for dynamic address, IPIKE_MAX_EXCHANGES and
IPIKE_ALLOW_DUPLICATE_SA configuration parameters
(WIND00089895).
01b,07feb07,tkf Add IPIKE dependency on SELECTION_IPCOM_FS.
01a,08jan07,kch Removed trailing ctrl-M characters.
*/
#ifdef _WRS_CONFIG_COMPONENT_IPIKE
Component INCLUDE_INTERNET_KEY_EXCHANGE
{
NAME Internet Key Exchange (IKE)
SYNOPSIS Dynamic keying for security association
CONFIGLETTES ipike_config.c
CFG_PARAMS IPIKE_SOCK_BUF_SIZE \
IPIKE_MAX_EXCHANGES \
IPIKE_PORT \
IPIKE_NAT_PORT \
IPIKE_NAT_KEEPALIVE \
IPIKE_LIVENESS_TIMER_RESOLUTION \
IPIKE_RESEND_DELAY \
IPIKE_CONFIG_FILE_NAME \
IPIKE_CONFIG_FILE_PATH \
IPIKE_NONCE_SIZE \
IPIKE_CREATE_DEFAULT_CONFIG_FILE \
IPIKE_FLUSH_STARTUP \
IPIKE_FLUSH_SHUTDOWN \
IPIKE_FLUSH_RECONFIGURE \
IPIKE_SOFT_TO_HARD_TIME \
IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4 \
IPIKE_DYNAMIC_ADDRESS_POOL_DNS4 \
IPIKE_DYNAMIC_ADDRESS_MODE \
IPIKE_DYNAMIC_ADDRESS_ANYFLOW \
IPIKE_DYNAMIC_ADDRESS_HOMEADDR \
IPIKE_REKEY_FUZZINESS \
IPIKE_USE_HASH_AND_URL \
IPIKE_HTTP_REQUEST_TIMEOUT \
IPIKE_HTTP_RESPONSE_BUF_SIZE \
IPIKE_MAX_IKE_SA_NUM \
IPIKE_MAX_IPSEC_SA_NUM \
IPIKE_MAX_MESSAGE_SIZE \
MODULES ipike.o
REQUIRES INCLUDE_IPNET_SOCKET INCLUDE_IPCRYPTO \
SELECT_IPCOM_FS INCLUDE_IP_SECURITY \
INCLUDE_IPCOM_USE_KEY_DB
}
Parameter IPIKE_SOCK_BUF_SIZE
{
NAME Socket buffer size
SYNOPSIS ISAKMP socket buffer size (in bytes), this is the largest ISAKMP message the IKE daemon can send and receive.
TYPE string
DEFAULT "10000"
}
Parameter IPIKE_MAX_EXCHANGES
{
NAME Maximum number of active exchanges
SYNOPSIS The maximum number of active exchanges, ISAKMP packets for new \
exchanges will be dropped when the maximum is reached. \
Set to 0 to allow infinite number of exchanges.
TYPE string
DEFAULT "32"
}
Parameter IPIKE_PORT
{
NAME IKE Port
SYNOPSIS Specifies the UDP port on which to listen for ISAKMP packets. Should be 500 in most cases.
TYPE string
DEFAULT "500"
}
Parameter IPIKE_NAT_PORT
{
NAME IKE NAT-T port
SYNOPSIS Specifies the UDP port on which to listen for ISAKMP NATTraversal packets. Must be 4500 to interoperate with other clients.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_NAT_KEEPALIVE
{
NAME Time between NAT keepalive messages
SYNOPSIS Specifies the number of seconds between keep alive packets when NAT-Traversal is used.
TYPE string
DEFAULT "20"
}
Parameter IPIKE_RESEND_DELAY
{
NAME IKE message resend delay
SYNOPSIS The time (in seconds) the IKE daemon will wait before doing the \
first resend of a packet. IKE will wait two times this value between \
the first and second resend, three times the value until the \
third resend, etc.
TYPE string
DEFAULT "2"
}
Parameter IPIKE_LIVENESS_TIMER_RESOLUTION
{
NAME IKE liveness timer resolution
SYNOPSIS The time period (in seconds) in which the IKE daemon will traverse \
all IPsec SA entries and perform liveness check (any packets received). \
A lower value will allow faster detection of dead remote peers but use more \
CPU resources. A value of 0 will disable the timer and liveness checking.
TYPE string
DEFAULT "10"
}
Parameter IPIKE_CONFIG_FILE_NAME
{
NAME Name of the IKE config file
SYNOPSIS The name of the file that will be used to configure the IKE daemon on startup.
TYPE string
DEFAULT "ike.cfg"
}
Parameter IPIKE_CONFIG_FILE_PATH
{
NAME Path to the IKE config file
SYNOPSIS The path the IKE daemon will use to locate the configuration file.
TYPE string
DEFAULT "/ram/"
}
Parameter IPIKE_NONCE_SIZE
{
NAME Size of created nonces
SYNOPSIS The size (in bytes) of the nonce (random number) that the IKE \
daemon will generate during phase 1 exchange. Must be between \
8 and 256 (inclusive) bytes.
TYPE string
DEFAULT "64"
}
Parameter IPIKE_CREATE_DEFAULT_CONFIG_FILE
{
NAME Create IKE config file
SYNOPSIS IPIKE will create a default configuration file for acting as a \
responder using preshared secret if this variable is set to 1 \
and there is no configuration file with the name specified by \
ipike.filename present.
TYPE string
DEFAULT "1"
}
Parameter IPIKE_FLUSH_STARTUP
{
NAME Flush keys at startup
SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys at startup.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_FLUSH_SHUTDOWN
{
NAME Flush keys at shutdown
SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys at shutdown.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_FLUSH_RECONFIGURE
{
NAME Flush keys on reconfigure
SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys when reconfigured.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_SOFT_TO_HARD_TIME
{
NAME IPSec SA soft to hard time
SYNOPSIS The IPSec SA soft timeout expires this many seconds earlier than the hard timeout.
TYPE string
DEFAULT "300"
}
Parameter IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4
{
NAME Dynamic address pool network4
SYNOPSIS This string is used to specify ip network for IPv4 dynamic address pool (responder).
TYPE string
DEFAULT "10.1.111.1/24"
}
Parameter IPIKE_DYNAMIC_ADDRESS_POOL_DNS4
{
NAME Dynamic address pool dns4
SYNOPSIS This string is used to specify dns ip address for IPv4 dynamic address pool (responder).
TYPE string
DEFAULT "10.1.1.1"
}
Parameter IPIKE_DYNAMIC_ADDRESS_MODE
{
NAME Dynamic address mode
SYNOPSIS This string is used to specify dynamic address mode for IKE version 1 protocol (initiator).
TYPE string
DEFAULT "1"
}
Parameter IPIKE_DYNAMIC_ADDRESS_ANYFLOW
{
NAME Dynamic address anyflow
SYNOPSIS Set this flag to 1 to make the responder traffic selector match any address in case of dynamic addresses with IKEv2 (responder).
TYPE string
DEFAULT "0"
}
Parameter IPIKE_DYNAMIC_ADDRESS_HOMEADDR
{
NAME Dynamic address home address
SYNOPSIS Set this flag to 1 to add the initiator's dynamic address as a home address (initiator). \
The home address is the preferred source address.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_REKEY_FUZZINESS
{
NAME IKE rekey fuzziness
SYNOPSIS The rekey fuzziness is used for avoiding situations where both IKE peers initiate a rekey exchange simultaneously. \
A value of 20 will delay the rekey timer with a random amount of time between 0 and 20 seconds. The rekey fuzziness applies on \
both IKE SA and IPsec SA rekey. A value of 0 disables the fuzziness.
TYPE string
DEFAULT "20"
}
Parameter IPIKE_USE_HASH_AND_URL
{
NAME Enable Hash and URL
SYNOPSIS The Hash and URL feature allows IKEv2 peers to send and receive a hash digest of a certificate followed by a URL \
pointing out the actual location of the certificate. This allows IKE messages to be small and IP fragmentation can be avoided \
since certificates are fetched using HTTP instead. The feature is disabled by default since there is a potential \
security risk of accepting a URL from an unauthenticated peer, set this flag to 1 to enable support for it.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_HTTP_REQUEST_TIMEOUT
{
NAME IKE HTTP request timeout
SYNOPSIS The maximum number of seconds the IKE daemon will wait for an HTTP response.
TYPE string
DEFAULT "5"
}
Parameter IPIKE_HTTP_RESPONSE_BUF_SIZE
{
NAME IKE HTTP response buffer size
SYNOPSIS This value controls the largest possible HTTP response the IKE dameon can receive.
TYPE string
DEFAULT "4096"
}
Parameter IPIKE_MAX_IKE_SA_NUM
{
NAME Maximum number of IKE SAs
SYNOPSIS Specifies the maximum number of concurrent IKE SAs that can be established. \
Set to 0 to allow infinite number of IKE SAs.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_MAX_IPSEC_SA_NUM
{
NAME Maximum number of IPsec SAs
SYNOPSIS Specifies the maximum number of concurrent IPsec SAs that can be established. \
Set to 0 to allow infinite number of IPsec SAs.
TYPE string
DEFAULT "0"
}
Parameter IPIKE_MAX_MESSAGE_SIZE
{
NAME Maximum size of an IKE message
SYNOPSIS Specifies the maximum size of an IKE message. This restriction will be applied \
on both outgoing and incoming IKE traffic.
Set to 0 to for unlimited size (limited by the maximum UDP packet size).
TYPE string
DEFAULT "0"
}
#endif
components/ip_net2-6.9/ipike/config/common.vxconfig
+12
View File
@@ -0,0 +1,12 @@
# Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: common.vxconfig,v $ $Revision: 1.10 $
# $Source: /home/interpeak/CVSRoot/ipike/config/common.vxconfig,v $
# $Author: myakan $
# $State: Exp $ $Locker: $
#
# INTERPEAK_COPYRIGHT_STRING
#hidden option that enables IPIKE
config SUPPORTS_IKE
bool
default y
components/ip_net2-6.9/ipike/config/ipike_config.c
+250
View File
@@ -0,0 +1,250 @@
/*
******************************************************************************
* INTERPEAK CONFIGURATION SOURCE FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_config.c,v $ $Revision: 1.27.2.6 $
* $Source: /home/interpeak/CVSRoot/ipike/config/ipike_config.c,v $
* $Author: svc-cmnet $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/*
****************************************************************************
* 2 INCLUDE FILES
****************************************************************************
*/
#include "ipike_config.h"
#define IPCOM_USE_CLIB_PROTO
#include <ipcom_sysvar.h>
#include <ipcom_err.h>
#include <ipcom_sock.h>
#include <ipcom_file.h>
#include <ipcom_clib.h>
#include <ipcom_syslog.h>
/*
****************************************************************************
* 3 DEFINES
****************************************************************************
*/
/*
****************************************************************************
* 4 TYPES
****************************************************************************
*/
/*
****************************************************************************
* 5 EXTERN PROTOTYPES
****************************************************************************
*/
/*
*===========================================================================
* ipike_configure
*===========================================================================
*/
IP_PUBLIC Ip_err
ipike_configure(void);
/*
****************************************************************************
* 6 LOCAL PROTOTYPES
****************************************************************************
*/
/*
****************************************************************************
* 7 DATA
****************************************************************************
*/
/*
*===========================================================================
* SYSTEM VARIABLES
*===========================================================================
*/
IP_CONST Ipcom_sysvar ipike_conf_sysvar[] = {
/* ISAKMP socket buffer size (in bytes), this is the largest ISAKMP message
the IKE daemon can send and receive */
IP_SYSVAR("ipike.isakmp_sock_buf_size", "10000", IPIKE_SOCK_BUF_SIZE),
/* The maximum number of active exchanges, ISAKMP packets for new exchanges
will be dropped when the maximum is reached. Set to 0 to allow infinite
number of exchanges. */
IP_SYSVAR("ipike.isakmp_max_exchanges", "32", IPIKE_MAX_EXCHANGES),
/* The maximum size of an ISAKMP packet. Note that all IKEv2
implementations MUST be able to send, receive, and process
IKE messages that are up to 1280 octets long, and they SHOULD be able
to send, receive, and process messages that are up to 3000 octets
long. Set to 0 for unlimited (max UDP packet size) */
IP_SYSVAR("ipike.max_message_size", "0", IPIKE_MAX_MESSAGE_SIZE),
/* The maximum number of IKE SAs that are allowed to be established
* at the same time. New negotiations will be rejected when this limit
* is reached. Set to 0 for no restrictions */
IP_SYSVAR("ipike.max_ike_sa_num", "0", IPIKE_MAX_IKE_SA_NUM),
/* The maximum number of IPsec SAs that are allowed to be established
* at the same time. New requests will be rejected when this limit
* is reached. Note that IPsec SAs are intalled in pairs, one for
* outgoing traffic and one for incomming traffic so normally two
* IPsec SA are installed for each peer. Set to 0 for no restrictions */
IP_SYSVAR("ipike.max_ipsec_sa_num", "0", IPIKE_MAX_IPSEC_SA_NUM),
/* The UDP port on which to listen for ISAKMP packets.
500 is the default IKE port */
IP_SYSVAR("ipike.port", "500", IPIKE_PORT),
/* The UDP port on which to listen for ISAKMP packets when using NAT-Traversal.
The only supported number is 4500 (limitation IPNet).*/
IP_SYSVAR("ipike.port_nat", "4500", IPIKE_NAT_PORT),
/* Number of seconds between NAT-Traversal keep-alive packets. Default
20 seconds. */
IP_SYSVAR("ipike.keepalive_nat", "20", IPIKE_NAT_KEEPALIVE),
/* Base time to wait (in seconds) before resending a ISAKMP message,
the time to wait is calulated on tWait = ipike.resend_delay * resend_count */
IP_SYSVAR("ipike.resend_delay", "2", IPIKE_RESEND_DELAY),
/* The filename where the configuration is stored */
#if defined(IP_PORT_LAS)
IP_SYSVAR("ipike.filename", IPCOM_DEFAULT_CONF_ROOT "/ike.cfg", IPIKE_CONFIG_FILE_PATH IPIKE_CONFIG_FILE_NAME),
#else
IP_SYSVAR("ipike.filename", IPCOM_FILE_ROOT "ike.cfg", IPIKE_CONFIG_FILE_PATH IPIKE_CONFIG_FILE_NAME),
#endif
/* The size (in bytes) of the created nonce (must be 8-256) */
IP_SYSVAR("ipike.nonce_size", "64", IPIKE_NONCE_SIZE),
/* Set this to 0 if IPIKE should not create a default 'ipike.filename' if
no such already exists */
IP_SYSVAR( "ipike.create_default_conf", "1", IPIKE_CREATE_DEFAULT_CONFIG_FILE),
/* Internal configuration variable. Set to 1 to allow duplicate IKE SAs */
IP_SYSVAR("ipike.allow_duplicate_ike_sa", "0", "0"),
/* Set flush to 1 if IPIKE should flush IPSec keys at startup or shutdown,
only needed when not running Interpeak IPSec */
#if !defined(IPIPSEC2) && !defined(IPIPSEC) && !defined(IP_PORT_OSE5)
IP_SYSVAR("ipike.pfkeyv2.flush_startup", "1", IPIKE_FLUSH_STARTUP),
IP_SYSVAR("ipike.pfkeyv2.flush_shutdown", "0", IPIKE_FLUSH_SHUTDOWN),
#endif
/* Enable this sysvar */
IP_SYSVAR("ipike.pfkeyv2.flush_reconfigure", "0", IPIKE_FLUSH_RECONFIGURE),
/* Number of seconds before the hard timeout the soft timeout (and the renewal
negotiation) should be */
IP_SYSVAR("ipike.pfkeyv2.soft_to_hard_time", "300", IPIKE_SOFT_TO_HARD_TIME),
/* Dynamic address pool (responder), used for test to simulate VPN gateway */
IP_SYSVAR("ipike.address_pool.network4", "10.1.111.1/24", IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4),
IP_SYSVAR("ipike.address_pool.dns4", "10.1.1.1", IPIKE_DYNAMIC_ADDRESS_POOL_DNS4),
IP_SYSVAR("ipike.address_pool.anyflow", "0", IPIKE_DYNAMIC_ADDRESS_ANYFLOW),
IP_SYSVAR("ipike.address_pool.homeaddr", "0", IPIKE_DYNAMIC_ADDRESS_HOMEADDR),
/* Dynamic address mode IKE v1 (initiator):
* 0 : Will set IPSec src flow as "any" address
* 1 : Will set IPSec src flow as retrieved address
* 2 : Will set IPSec src flow as retrieved network */
IP_SYSVAR("ipike.dynamic_address.mode", "1", IPIKE_DYNAMIC_ADDRESS_MODE),
/* Set to '1' to enable MOBIKE (RFC4555), default '0' */
IP_SYSVAR("ipike.mobike", "0", "0"),
/* Set to '1' to enable routability check for MOBIKE, default '1' */
IP_SYSVAR("ipike.mobike.routability_check", "1", "1"),
/* Set to '1' to initiate rekey for IPSec SAs for passive connections. */
IP_SYSVAR("ipike.rekey_passive", "1", "1"),
/* Rekey fuzziness in seconds, adds a random time to rekey margin */
IP_SYSVAR("ipike.rekey_fuzziness", "20", IPIKE_REKEY_FUZZINESS),
/* The liveness timer resolution in seconds */
IP_SYSVAR("ipike.liveness_timer_resolution", "10", IPIKE_LIVENESS_TIMER_RESOLUTION),
/* Allow fetching of certificates via HTTP */
IP_SYSVAR("ipike.use_hash_and_url", "0", IPIKE_USE_HASH_AND_URL),
/* Number of seconds before timing out an HTTP request */
IP_SYSVAR("ipike.http_request_timeout", "5", IPIKE_HTTP_REQUEST_TIMEOUT),
/* HTTP response buffer size in bytes */
IP_SYSVAR("ipike.http_response_buf_size", "4096", IPIKE_HTTP_RESPONSE_BUF_SIZE),
/* Set to '1' to enable strict lifetime checking when accepting proposals */
{ "ipike.strict_lifetime_policy", "0"},
/* Remove IKE SA if the negotiation of the IPsec SA fails, default '0' */
{ "ipike.policy.delete_phase1_on_phase2_failure", "0" },
/* End marker */
{ IP_NULL, IP_NULL }
};
/*
****************************************************************************
* 8 STATIC FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 9 GLOBAL FUNCTIONS
****************************************************************************
*/
/*
****************************************************************************
* 10 PUBLIC FUNCTIONS
****************************************************************************
*/
/*
*===========================================================================
* ipike_configure
*===========================================================================
* Description: Configures IPIKE.
* Parameters:
* Returns:
*
*/
IP_PUBLIC Ip_err
ipike_configure(void)
{
/* Set IPNET system variables. */
(void)ipcom_sysvar_setv(ipike_conf_sysvar, 0);
#if defined(IP_DEBUG) && !defined(IP_PORT_VXWORKS)
(void)ipcom_setlogmask_on(IPCOM_LOG_DEBUG2, IPCOM_LOG_IPIKE);
#endif
return IPCOM_SUCCESS;
}
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/
components/ip_net2-6.9/ipike/config/ipike_config.h
+407
View File
@@ -0,0 +1,407 @@
/*
******************************************************************************
* HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_config.h,v $ $Revision: 1.34.10.7 $
* $Source: /home/interpeak/CVSRoot/ipike/config/ipike_config.h,v $
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:25 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
******************************************************************************
*/
#ifndef IPIKE_CONFIG_H
#define IPIKE_CONFIG_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
*/
/* Defines for IPIKE */
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include <ipcom_config.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 CONFIGURATION
****************************************************************************
*/
/*
*===========================================================================
* IPIKE_USE_VERSION2
*===========================================================================
* Set define to enable IKE version2 protocol.
*/
#define IPIKE_USE_VERSION2
/*
*===========================================================================
* IPIKE_USE_EAP
*===========================================================================
* Set define to enable EAP authentication mechanism for IKE version2
* protocol.
*/
#if defined(IPIKE_USE_VERSION2) && defined(IPEAP)
#define IPIKE_USE_EAP
#endif
/*
*===========================================================================
* IPIKE_USE_RADIUS
*===========================================================================
* Set define to enable Radius. This define is needed for responder (EAP
* Supplicant) when running EAP authentication mechanism for IKE version2.
*/
#if defined(IPIKE_USE_EAP) && defined(IPRADIUS)
#define IPIKE_USE_RADIUS
#endif
/*
*===========================================================================
* IPIKE_USE_ROHC
*===========================================================================
* Set define to enable ROHC parameter negotiation using IKEV2.
*/
#if defined(IPIKE_USE_VERSION2) && defined(IPROHC)
#define IPIKE_USE_ROHC
#endif
/*
*===========================================================================
* IPIKE_USE_AGGRESSIVE_MODE
*===========================================================================
* Set define to enable aggressive mode negotiation for IKE version1
* protocol.
*/
#define IPIKE_USE_AGGRESSIVE_MODE
/*
*===========================================================================
* IPIKE_REAUTH_MARGIN_SEC
*===========================================================================
* The number of seconds before the IKE SA expires that reauthentication
* should take place.
*/
#define IPIKE_REAUTH_MARGIN_SEC 20
/*
*===========================================================================
* IPIKE_REKEY_MARGIN_SEC
*===========================================================================
* The number of seconds before the IKE SA expires that rekey should take
* place. Let rekey have some advantage compared to reauthentication by
* doubling the margin.
*/
#define IPIKE_REKEY_MARGIN_SEC (IPIKE_REAUTH_MARGIN_SEC + IPIKE_REAUTH_MARGIN_SEC)
/*
*===========================================================================
* IPIKE_REKEY_RETRY_TIMEOUT_MS
*===========================================================================
* The number of milliseconds to wait before retrying a rekey when the
* IKE SA is busy (exchange in progress). This timeout is also used for the
* same purpose when performing a reauhtentication.
*/
#define IPIKE_REKEY_RETRY_TIMEOUT_MS 1000
/*
*===========================================================================
* IPIKE_USE_CRYPTO_TEST
*===========================================================================
* Enable crypto self test on startup
*/
#if defined(IP_DEBUG) && defined(IPIKE_USE_VERSION2)
#define IPIKE_USE_CRYPTO_SELF_TEST
#endif
/*
*===========================================================================
* IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS
*===========================================================================
* The number of milliseconds to wait before retrying a INFORMATION exchange when the
* IKE SA is busy (exchange in progress).
*/
#define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS 1000
/*
*===========================================================================
* IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE
*===========================================================================
* when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue.
* The default size of queue is 10.
*/
#define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE 10
/*
*===========================================================================
* IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS
*===========================================================================
* The number of milliseconds to wait before retrying a INFORMATION exchange when the
* IKE SA is busy (exchange in progress).
*/
#define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS 1000
/*
*===========================================================================
* IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE
*===========================================================================
* when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue.
* The default size of queue is 10.
*/
#define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE 10
/*
*===========================================================================
* IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND
*===========================================================================
* The ISAKMPD (on OpenBSD) will not allow that the key length is transmitted
* in the payloads during phase 1 or phase2. It will also consider the key
* length to be 256 bits during phase1 and 128 bits during phase 2.
*
* NOTE: This define will result in a bug, since there is no default for AES,
* at least not during phase 1.
*/
/*#define IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND*/
/*
*===========================================================================
* IPIKE_USE_AES_MAC
*===========================================================================
*
*/
#if !defined(OPENSSL_NO_AES) && defined(IPCRYPTO)
#define IPIKE_USE_AES_MAC
#endif
/*
*===========================================================================
* IPCOM_SYSLOG_PRIORITY
*===========================================================================
* Default syslog priority.
*/
#if defined(_WRS_CONFIG_IPIKE_SYSLOG_PRIORITY)
#define IPIKE_SYSLOG_PRIORITY _WRS_CONFIG_IPIKE_SYSLOG_PRIORITY
#else
#define IPIKE_SYSLOG_PRIORITY IPCOM_SYSLOG_PRIO_DEFAULT
#endif
/*
*===========================================================================
* IPIKE_USE_PKTINFO
*===========================================================================
* Use PKTINFO processing to be able to listen on :: or 0.0.0.0.
* Can be only used if IPNET is defined
*/
#if defined(IPNET)
#define IPIKE_USE_PKTINFO
#endif
/*
*===========================================================================
* IPIKE_USE_MIGRATE
*===========================================================================
* Define to enable pfkey migrate support for MIP daemons.
* Is dependent on pfkey defines in IPIPSEC and complaint behavior
* from MIP daemons.
* Currently IKE and IPSEC does not handle the MIGRATE messages
*/
/* #define IPIKE_USE_MIGRATE */
/*
*===========================================================================
* IPIKE_USE_PERF_EVAL
*===========================================================================
* Performance evaluation code for IKEv1 and v2
*
*/
#define IPIKE_USE_PERF_EVAL
/*
*===========================================================================
* IPIKE_USE_OCSP
*===========================================================================
* Use OCSP req/responses to verify certificate validity status
*
*/
#if !defined(OPENSSL_NO_OCSP) && defined(IPCRYPTO)
#define IPIKE_USE_OCSP
#endif
/*
*===========================================================================
* IPIKE_DPD_WINDOW_SIZE
*===========================================================================
* For IKEv1 only. This setting specifies the size of the DPD window which
* contains acceptable sequence numbers.
*
*/
#define IPIKE_DPD_WINDOW_SIZE 10
/*
*===========================================================================
* IPIKE_IKEV2_MAX_EXCH_IN_NEG
*===========================================================================
* For IKEv2 only. This setting specifies the maximum number of exchanges
* that is allowed to complete an IKEv2 negotiation. An IKEv2 negotiation is
* normally completed within 2 exchanges (one INIT and one AUTH) but if EAP
* is used as authentication method more exchanges are required. One exchange
* consists of one request-response message pair.
*
*/
#define IPIKE_IKEV2_MAX_EXCH_IN_NEG 15
/*
*===========================================================================
* IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD
*===========================================================================
* If two or more IKE SAs from the same remote peer are established within
* this period of seconds they will be treated as a simultaneous (collision)
* exchange and the IKE SA containing the smallest nonce will be removed.
*
*/
#define IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD 1
/*
*===========================================================================
* IPIKE_DISPATCHER_RECEIVE_RETRIES
*===========================================================================
* Number of times the IKE dispatcher will tolerate receive errors before
* it reconfigures itself (re-open listening UDP sockets)
*
*/
#define IPIKE_DISPATCHER_RECEIVE_RETRIES 3
/*
*===========================================================================
* IPIKE_USE_EVENT_LOG
*===========================================================================
* IKE Event logging. Each type of log event can be explicitly be removed
* at compile time by either removing the corresponding define below or
* by adding a #undef directive. Some of these events are triggered in the
* IPsec module and some in the IPIKE module. Events triggered from IPsec
* are sent to the IKE daemon via pfkeyv2 and then relayed to registered
* event receivers
*
*/
#ifdef _WRS_CONFIG_COMPONENT_IPIKE_USE_EVENT_LOG
/* Global switch, enables event logging */
#define IPIKE_USE_EVENT_LOG
#endif
#ifdef IPIKE_USE_EVENT_LOG
/*
* Log events, enable/disable specific log events here at compile time. By
* default all is turned on.
*/
/* Phase 2 hard lifesize expired */
#define IPIKE_USE_EVENT_HARD_LIFE_SIZE_EXPIRED
/* Phase 2 hard lifetime expired */
#define IPIKE_USE_EVENT_HARD_LIFE_TIME_EXPIRED
/* An IKE packet was discarded */
#define IPIKE_USE_EVENT_IKE_PACKET_DISCARD
/* Phase 1 (IKE SA) negotiation failed */
#define IPIKE_USE_EVENT_IKE_PHASE_I_FAIL
/* Phase 1 (IKE SA) negotiation completed successfully */
#define IPIKE_USE_EVENT_IKE_PHASE_I_SUCCESS
/* Phase 2 (IPsec SA) negotiation failed */
#define IPIKE_USE_EVENT_IKE_PHASE_II_FAIL
/* Phase 2 (IPsec SA) negotiation completed */
#define IPIKE_USE_EVENT_IKE_PHASE_II_SUCCESS
/* IPsec packet was discarded */
#define IPIKE_USE_EVENT_IPSEC_PACKET_DISCARD
/* IPsec SA sequence number overflowed or rolled over */
#define IPIKE_USE_EVENT_SEQUENCE_NUM_OVERFLOW
/* Phase 2 (IPsec SA) soft lifetime in bytes expired */
#define IPIKE_USE_EVENT_SOFT_LIFE_SIZE_EXPIRED
/* Phase 2 (IPsec SA) soft lifetime in time expired */
#define IPIKE_USE_EVENT_SOFT_LIFE_TIME_EXPIRED
/* An SPD packet was discarded */
#define IPIKE_USE_EVENT_SPD_PACKET_DISCARD
#endif /* IPIKE_USE_EVENT_LOG */
/*
*===========================================================================
* IPIKE_CONFIG_ROHC_INTEG_NUM_MAX
*===========================================================================
* The maximum number of integrity algorithms that can be configured and
* proposed when ROHC is enabled
*/
#define IPIKE_CONFIG_ROHC_INTEG_NUM_MAX 7
/*
*===========================================================================
* IPIKE_CONFIG_ROHC_INTEG_NUM_MAX
*===========================================================================
* The maximum number of ROHC profiles that can be configured.
*/
#define IPIKE_CONFIG_ROHC_PROFILE_NUM_MAX 8
/*
*===========================================================================
* IPIKE_ROHC_IFNAME_SIZE
*===========================================================================
* ROHC Interface name sizes
*/
#define IPIKE_ROHC_IFNAME_SIZE 16
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/