original files of m241

components/ip_net2-6.9/ipike/config/ipike_config.h

@@ -0,0 +1,407 @@
+/*
+ ******************************************************************************
+ *                     HEADER FILE
+ *
+ *     Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_config.h,v $ $Revision: 1.34.10.7 $
+ *     $Source: /home/interpeak/CVSRoot/ipike/config/ipike_config.h,v $
+ *     $Author: svc-cmnet $ $Date: 2013-03-13 07:45:25 $
+ *     $State: Exp $ $Locker:  $
+ *
+ *     INTERPEAK_COPYRIGHT_STRING
+ *        Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
+ ******************************************************************************
+ */
+#ifndef IPIKE_CONFIG_H
+#define IPIKE_CONFIG_H
+
+/*
+ ****************************************************************************
+ * 1                    DESCRIPTION
+ ****************************************************************************
+ */
+
+/* Defines for IPIKE */
+
+/*
+ ****************************************************************************
+ * 2                    CONFIGURATION
+ ****************************************************************************
+ */
+
+/*
+ ****************************************************************************
+ * 3                    INCLUDE FILES
+ ****************************************************************************
+ */
+#include <ipcom_config.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ ****************************************************************************
+ * 4                       CONFIGURATION
+ ****************************************************************************
+ */
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_VERSION2
+ *===========================================================================
+ * Set define to enable IKE version2 protocol.
+ */
+#define IPIKE_USE_VERSION2
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_EAP
+ *===========================================================================
+ * Set define to enable EAP authentication mechanism for IKE version2
+ * protocol.
+ */
+#if defined(IPIKE_USE_VERSION2) && defined(IPEAP)
+#define IPIKE_USE_EAP
+#endif
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_RADIUS
+ *===========================================================================
+ * Set define to enable Radius. This define is needed for responder (EAP
+ * Supplicant) when running EAP authentication mechanism for IKE version2.
+ */
+#if defined(IPIKE_USE_EAP) && defined(IPRADIUS)
+#define IPIKE_USE_RADIUS
+#endif
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_ROHC
+ *===========================================================================
+ * Set define to enable ROHC parameter negotiation using IKEV2.
+ */
+#if defined(IPIKE_USE_VERSION2) && defined(IPROHC)
+#define IPIKE_USE_ROHC
+#endif
+
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_AGGRESSIVE_MODE
+ *===========================================================================
+ * Set define to enable aggressive mode negotiation for IKE version1
+ * protocol.
+ */
+#define IPIKE_USE_AGGRESSIVE_MODE
+
+/*
+ *===========================================================================
+ *                         IPIKE_REAUTH_MARGIN_SEC
+ *===========================================================================
+ * The number of seconds before the IKE SA expires that reauthentication 
+ * should take place. 
+ */
+#define IPIKE_REAUTH_MARGIN_SEC     20
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_REKEY_MARGIN_SEC
+ *===========================================================================
+ * The number of seconds before the IKE SA expires that rekey should take
+ * place. Let rekey have some advantage compared to reauthentication by
+ * doubling the margin.
+ */
+#define IPIKE_REKEY_MARGIN_SEC  (IPIKE_REAUTH_MARGIN_SEC + IPIKE_REAUTH_MARGIN_SEC)
+
+
+/*
+ *===========================================================================
+ *                      IPIKE_REKEY_RETRY_TIMEOUT_MS
+ *===========================================================================
+ * The number of milliseconds to wait before retrying a rekey when the
+ * IKE SA is busy (exchange in progress). This timeout is also used for the
+ * same purpose when performing a reauhtentication.
+ */
+#define IPIKE_REKEY_RETRY_TIMEOUT_MS    1000
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_CRYPTO_TEST
+ *===========================================================================
+ * Enable crypto self test on startup
+ */
+#if defined(IP_DEBUG) && defined(IPIKE_USE_VERSION2)
+#define IPIKE_USE_CRYPTO_SELF_TEST
+#endif
+
+
+/*
+ *===========================================================================
+ *                      IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS
+ *===========================================================================
+ * The number of milliseconds to wait before retrying a INFORMATION exchange when the
+ * IKE SA is busy (exchange in progress). 
+ */
+#define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS    1000
+
+/*
+ *===========================================================================
+ *                      IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE
+ *===========================================================================
+ * when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue.
+ * The default size of queue is 10.
+ */
+#define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE    10
+
+/*
+ *===========================================================================
+ *                      IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS
+ *===========================================================================
+ * The number of milliseconds to wait before retrying a INFORMATION exchange when the
+ * IKE SA is busy (exchange in progress). 
+ */
+#define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS    1000
+
+/*
+ *===========================================================================
+ *                      IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE
+ *===========================================================================
+ * when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue.
+ * The default size of queue is 10.
+ */
+#define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE    10
+
+/*
+ *===========================================================================
+ *                         IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND
+ *===========================================================================
+ * The ISAKMPD (on OpenBSD) will not allow that the key length is transmitted
+ * in the payloads during phase 1 or phase2. It will also consider the key
+ * length to be 256 bits during phase1 and 128 bits during phase 2.
+ *
+ * NOTE: This define will result in a bug, since there is no default for AES,
+ *       at least not during phase 1.
+ */
+/*#define IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND*/
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_AES_MAC
+ *===========================================================================
+ *
+ */
+#if !defined(OPENSSL_NO_AES) && defined(IPCRYPTO)
+#define IPIKE_USE_AES_MAC
+#endif
+
+/*
+ *===========================================================================
+ *                         IPCOM_SYSLOG_PRIORITY
+ *===========================================================================
+ * Default syslog priority.
+ */
+#if defined(_WRS_CONFIG_IPIKE_SYSLOG_PRIORITY)
+#define IPIKE_SYSLOG_PRIORITY _WRS_CONFIG_IPIKE_SYSLOG_PRIORITY
+#else
+#define IPIKE_SYSLOG_PRIORITY IPCOM_SYSLOG_PRIO_DEFAULT
+#endif
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_PKTINFO
+ *===========================================================================
+ * Use PKTINFO processing to be able to listen on :: or 0.0.0.0.
+ * Can be only used if IPNET is defined
+ */
+#if defined(IPNET)
+#define IPIKE_USE_PKTINFO
+#endif
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_MIGRATE
+ *===========================================================================
+ * Define to enable pfkey migrate support for MIP daemons.
+ * Is dependent on pfkey defines in IPIPSEC and complaint behavior
+ * from MIP daemons.
+ * Currently IKE and IPSEC does not handle the MIGRATE messages
+ */
+/* #define IPIKE_USE_MIGRATE */
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_PERF_EVAL
+ *===========================================================================
+ *  Performance evaluation code for IKEv1 and v2
+ *
+ */
+#define IPIKE_USE_PERF_EVAL
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_USE_OCSP
+ *===========================================================================
+ *  Use OCSP req/responses to verify certificate validity status
+ *
+ */
+#if !defined(OPENSSL_NO_OCSP) && defined(IPCRYPTO)
+#define IPIKE_USE_OCSP
+#endif
+
+
+/*
+ *===========================================================================
+ *                         IPIKE_DPD_WINDOW_SIZE
+ *===========================================================================
+ *  For IKEv1 only. This setting specifies the size of the DPD window which
+ *  contains acceptable sequence numbers.
+ *
+ */
+#define IPIKE_DPD_WINDOW_SIZE 10
+
+
+/*
+ *===========================================================================
+ *                  IPIKE_IKEV2_MAX_EXCH_IN_NEG
+ *===========================================================================
+ *  For IKEv2 only. This setting specifies the maximum number of exchanges 
+ *  that is allowed to complete an IKEv2 negotiation. An IKEv2 negotiation is 
+ *  normally completed within 2 exchanges (one INIT and one AUTH) but if EAP 
+ *  is used as authentication method more exchanges are required. One exchange 
+ *  consists of one request-response message pair.
+ *
+ */
+#define IPIKE_IKEV2_MAX_EXCH_IN_NEG 15
+
+
+/* 
+ *===========================================================================
+ *              IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD
+ *===========================================================================
+ * If two or more IKE SAs from the same remote peer are established within 
+ * this period of seconds they will be treated as a simultaneous (collision) 
+ * exchange and the IKE SA containing the smallest nonce will be removed.
+ *  
+ */ 
+#define IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD 1
+
+
+/*
+ *===========================================================================
+ *              IPIKE_DISPATCHER_RECEIVE_RETRIES
+ *===========================================================================
+ * Number of times the IKE dispatcher will tolerate receive errors before
+ * it reconfigures itself (re-open listening UDP sockets)
+ *
+ */
+#define IPIKE_DISPATCHER_RECEIVE_RETRIES  3
+
+/*
+ *===========================================================================
+ *                          IPIKE_USE_EVENT_LOG
+ *===========================================================================
+ * IKE Event logging. Each type of log event can be explicitly be removed
+ * at compile time by either removing the corresponding define below or
+ * by adding a #undef directive. Some of these events are triggered in the
+ * IPsec module and some in the IPIKE module. Events triggered from IPsec
+ * are sent to the IKE daemon via pfkeyv2 and then relayed to registered
+ * event receivers
+ *
+ */
+
+#ifdef _WRS_CONFIG_COMPONENT_IPIKE_USE_EVENT_LOG
+/* Global switch, enables event logging */
+#define IPIKE_USE_EVENT_LOG
+#endif
+
+
+#ifdef IPIKE_USE_EVENT_LOG
+/*
+ * Log events, enable/disable specific log events here at compile time. By
+ * default all is turned on.
+ */
+
+/* Phase 2 hard lifesize expired */
+#define IPIKE_USE_EVENT_HARD_LIFE_SIZE_EXPIRED
+
+/* Phase 2 hard lifetime expired */
+#define IPIKE_USE_EVENT_HARD_LIFE_TIME_EXPIRED
+
+/* An IKE packet was discarded */
+#define IPIKE_USE_EVENT_IKE_PACKET_DISCARD
+
+/* Phase 1 (IKE SA) negotiation failed */
+#define IPIKE_USE_EVENT_IKE_PHASE_I_FAIL
+
+/* Phase 1 (IKE SA) negotiation completed successfully */
+#define IPIKE_USE_EVENT_IKE_PHASE_I_SUCCESS
+
+/* Phase 2 (IPsec SA) negotiation failed */
+#define IPIKE_USE_EVENT_IKE_PHASE_II_FAIL
+
+/* Phase 2 (IPsec SA) negotiation completed */
+#define IPIKE_USE_EVENT_IKE_PHASE_II_SUCCESS
+
+/* IPsec packet was discarded */
+#define IPIKE_USE_EVENT_IPSEC_PACKET_DISCARD
+
+/* IPsec SA sequence number overflowed or rolled over */
+#define IPIKE_USE_EVENT_SEQUENCE_NUM_OVERFLOW
+
+/* Phase 2 (IPsec SA) soft lifetime in bytes expired */
+#define IPIKE_USE_EVENT_SOFT_LIFE_SIZE_EXPIRED
+
+/* Phase 2 (IPsec SA) soft lifetime in time expired */
+#define IPIKE_USE_EVENT_SOFT_LIFE_TIME_EXPIRED
+
+/* An SPD packet was discarded */
+#define IPIKE_USE_EVENT_SPD_PACKET_DISCARD
+
+#endif /* IPIKE_USE_EVENT_LOG */
+
+/*
+ *===========================================================================
+ *                      IPIKE_CONFIG_ROHC_INTEG_NUM_MAX
+ *===========================================================================
+ * The maximum number of integrity algorithms that can be configured and
+ * proposed when ROHC is enabled
+ */
+#define IPIKE_CONFIG_ROHC_INTEG_NUM_MAX     7
+
+/*
+ *===========================================================================
+ *                      IPIKE_CONFIG_ROHC_INTEG_NUM_MAX
+ *===========================================================================
+ * The maximum number of ROHC profiles that can be configured.
+ */
+#define IPIKE_CONFIG_ROHC_PROFILE_NUM_MAX   8
+
+/*
+ *===========================================================================
+ *                      IPIKE_ROHC_IFNAME_SIZE
+ *===========================================================================
+ * ROHC Interface name sizes
+ */
+#define IPIKE_ROHC_IFNAME_SIZE              16
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
+
+/*
+ ****************************************************************************
+ *                      END OF FILE
+ ****************************************************************************
+ */