original files of m241
This commit is contained in:
neelimap
@@ -0,0 +1,559 @@
|
||||
/*
|
||||
******************************************************************************
|
||||
* HEADER FILE
|
||||
*
|
||||
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_h.h,v $ $Revision: 1.47.10.5 $
|
||||
|
||||
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_h.h,v $
|
||||
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
|
||||
* $State: Exp $ $Locker: $
|
||||
*
|
||||
* INTERPEAK_COPYRIGHT_STRING
|
||||
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
||||
******************************************************************************
|
||||
*/
|
||||
#ifndef IPIKE_H_H
|
||||
#define IPIKE_H_H
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 1 DESCRIPTION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 2 CONFIGURATION
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#include "ipike_config.h"
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 3 INCLUDE FILES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
#if defined(IPCRYPTO) && !defined(IPCOM_USE_CLIB_PROTO)
|
||||
#define IPCOM_USE_CLIB_PROTO
|
||||
#endif
|
||||
#include <ipcom.h>
|
||||
#include <ipcom_os.h>
|
||||
#include <ipcom_hash.h>
|
||||
#include <ipcom_list.h>
|
||||
#include <ipcom_tmo2.h>
|
||||
#include <ipcom_time.h>
|
||||
#include "ipike_util.h"
|
||||
#include "ipike_configuration.h"
|
||||
#include "ipike_pfkeyv2.h"
|
||||
|
||||
#ifdef IPIKE_USE_EVENT_LOG
|
||||
#include "ipike_event_server.h"
|
||||
/* Set event logging function before including ipike_event_log.h */
|
||||
#define IPIKE_EVENT_LOG_FUNC ipike_event_server_log
|
||||
#endif
|
||||
|
||||
#include "ipike_event_log.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 4 DEFINES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/* Support IKE version 1 protocol. Disable of IKE v1 not fullt implemented
|
||||
* yet, so this define MUST be set */
|
||||
#define IPIKE_USE_VERSION1 1
|
||||
|
||||
/* The name this service is using in the IPD machinery */
|
||||
#define IPIKE_IPD_NAME "ipike"
|
||||
|
||||
/* The name of the IKE daemon process */
|
||||
#define IPIKE_PROC_NAME "ipiked"
|
||||
|
||||
/* The name of the IKE control command */
|
||||
#define IPIKE_CMD_NAME "ike"
|
||||
|
||||
#define IPIKE_FREEP(p) do { ipcom_free((void *)p); p = IP_NULL; } while (0)
|
||||
|
||||
#ifdef IPIKE_USE_PKTINFO
|
||||
#define IPIKE_PKT_CLEN 128
|
||||
#else
|
||||
#define IPIKE_PKT_CLEN 0
|
||||
#endif
|
||||
|
||||
/* Mobility update related error messages */
|
||||
#define IPIKE_MOBIKE_UPDATE_INITIATED 0
|
||||
#define IPIKE_MOBIKE_INVALID_ADDRESS 1
|
||||
#define IPIKE_MOBIKE_SIMILAR_ADDRESS 2
|
||||
#define IPIKE_MOBIKE_LISTEN_NEW_FAILED 3
|
||||
#define IPIKE_MOBIKE_UPDATE_FAILED 4
|
||||
|
||||
/* IKE MIP comm protocol msg types */
|
||||
#define IPIKE_MOBIKE_UPDATE_LOCAL 0
|
||||
#define IPIKE_MOBIKE_UPDATE_REMOTE 1 /* Not used currently */
|
||||
#define IPIKE_MOBIKE_DYNAMIC_ADDRESS 2
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* syslog
|
||||
*===========================================================================
|
||||
*/
|
||||
#define IPCOM_SYSLOG_PRIORITY IPIKE_SYSLOG_PRIORITY
|
||||
#define IPCOM_SYSLOG_FACILITY IPCOM_LOG_IPIKE
|
||||
|
||||
|
||||
#ifdef IPCOM_USE_INET6
|
||||
#define IPIKE_ADDRSTRLEN IP_INET6_ADDRSTRLEN
|
||||
#else
|
||||
#define IPIKE_ADDRSTRLEN IP_INET_ADDRSTRLEN
|
||||
#endif
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* code lock
|
||||
*===========================================================================
|
||||
*/
|
||||
#define IPIKE_CODE_LOCK_INIT() if (ipike.code_lock_initialized == 0) \
|
||||
if (ipcom_mutex_create(&ipike.code_mutex) == 0) \
|
||||
ipike.code_lock_initialized = 1;
|
||||
#define IPIKE_CODE_LOCK_INITIALIZED() (ipike.code_lock_initialized == 1)
|
||||
|
||||
#define IPIKE_CODE_LOCK_DESTROY() \
|
||||
if (IPIKE_CODE_LOCK_INITIALIZED()) \
|
||||
do { \
|
||||
ipike.code_lock_initialized = 0; \
|
||||
ipcom_mutex_delete(&ipike.code_mutex); \
|
||||
} while(0)
|
||||
|
||||
|
||||
|
||||
#if defined (IP_ASSERT) && !defined(IP_PORT_LKM) && !defined(IP_PORT_VXWORKS)
|
||||
#define IPIKE_CODE_ISLOCKED() if (IPIKE_CODE_LOCK_INITIALIZED()) \
|
||||
ip_assert(ipike.code_mutex_count == 1)
|
||||
#define IPIKE_CODE_LOCK() if (!IPIKE_CODE_LOCK_INITIALIZED()) \
|
||||
IPIKE_CODE_LOCK_INIT(); \
|
||||
if (IPIKE_CODE_LOCK_INITIALIZED()) { \
|
||||
do { \
|
||||
ipcom_mutex_lock(ipike.code_mutex); \
|
||||
ipike.code_lock_owner = ipcom_getpid(); \
|
||||
ip_assert(ipike.code_mutex_count == 0); \
|
||||
ipike.code_mutex_count++; \
|
||||
} while((0)); \
|
||||
}
|
||||
#define IPIKE_CODE_UNLOCK() if IPIKE_CODE_LOCK_INITIALIZED() { \
|
||||
do { \
|
||||
ip_assert(ipike.code_lock_owner == ipcom_getpid()); \
|
||||
ip_assert(ipike.code_mutex_count == 1); \
|
||||
ipike.code_mutex_count--; \
|
||||
ipike.code_lock_owner = 0; \
|
||||
ipcom_mutex_unlock(ipike.code_mutex); \
|
||||
} while((0)); \
|
||||
}
|
||||
#else
|
||||
#define IPIKE_CODE_ISLOCKED() IP_NOOP
|
||||
#define IPIKE_CODE_LOCK() if (!IPIKE_CODE_LOCK_INITIALIZED()) \
|
||||
IPIKE_CODE_LOCK_INIT(); \
|
||||
if (IPIKE_CODE_LOCK_INITIALIZED()) \
|
||||
ipcom_mutex_lock(ipike.code_mutex)
|
||||
#define IPIKE_CODE_UNLOCK() if IPIKE_CODE_LOCK_INITIALIZED() \
|
||||
ipcom_mutex_unlock(ipike.code_mutex)
|
||||
#endif
|
||||
|
||||
#define IPIKE_IKE_SA_REACHED_LIMIT() \
|
||||
((ipike.max_ike_sa_num != 0 && ipike.ike_sa_num >= ipike.max_ike_sa_num))
|
||||
|
||||
#define IPIKE_IPSEC_SA_REACHED_LIMIT() \
|
||||
((ipike.max_ipsec_sa_num != 0 && ipike.ipsec_sa_num >= ipike.max_ipsec_sa_num))
|
||||
|
||||
|
||||
#define IPIKE_FLOW_TYPE_ACQUIRE 12
|
||||
#define IPIKE_FLOW_TYPE_REQUIRE 13
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 5 TYPES
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* Ipike_socket
|
||||
*===========================================================================
|
||||
*/
|
||||
typedef struct Ipike_socket_struct
|
||||
{
|
||||
Ipcom_list list;
|
||||
union Ip_sockaddr_union addr;
|
||||
Ip_fd fd;
|
||||
} Ipike_socket;
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* Ipike_flowtype_flow
|
||||
*===========================================================================
|
||||
*/
|
||||
typedef struct Ipike_flowtype_flow
|
||||
{
|
||||
Ipcom_list list;
|
||||
Ipike_config_flow flow;
|
||||
Ip_u8 flowtype;
|
||||
} Ipike_flowtype_flow;
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* Ipike_dispatcher
|
||||
*===========================================================================
|
||||
*/
|
||||
typedef struct Ipike_dispatcher_struct
|
||||
{
|
||||
Ip_bool initialized;
|
||||
Ipcom_atomic_t reconfigure;
|
||||
|
||||
Ipcom_list sockets; /* List of listening IKE (UDP) sockets */
|
||||
Ipcom_list flowtype_flows; /* List of 'require' or 'acquire' flows */
|
||||
|
||||
/* The UDP socket to listen for Radius messages on. */
|
||||
#ifdef IPIKE_USE_RADIUS
|
||||
Ip_fd* sock_radius;
|
||||
Ip_u32 sock_radius_count;
|
||||
Ip_u32 sock_radius_count_max;
|
||||
#endif
|
||||
|
||||
/* Socket waiting for IKE SA dump requests */
|
||||
Ip_fd shell_cmd_sock;
|
||||
/* Ticks, used to determine when houskeeping should be performed */
|
||||
int ticks;
|
||||
/* Buffer where data can (temporarily) be stored */
|
||||
Ip_size_t recv_buf_len;
|
||||
void * recv_buf;
|
||||
}
|
||||
Ipike_dispatcher;
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* Ipike_isakmp
|
||||
*===========================================================================
|
||||
*/
|
||||
typedef struct Ipike_isakmp_struct
|
||||
{
|
||||
Ip_bool initialized;
|
||||
/* Hash tables with on-going ISAKMP exchanges */
|
||||
Ipcom_hash* exchange_hash_table_cookie;
|
||||
Ipcom_hash* exchange_hash_table_spi;
|
||||
Ipcom_hash* exchange_hash_table_id;
|
||||
}
|
||||
Ipike_isakmp;
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* Ipike_sadb
|
||||
*===========================================================================
|
||||
*/
|
||||
typedef struct Ipike_sadb_struct
|
||||
{
|
||||
Ip_bool initialized;
|
||||
|
||||
/* Hash tables with IKE SA:s in constructing and active state */
|
||||
Ipcom_hash *cookie_hash_table;
|
||||
|
||||
/* Hash tables with the most recent IKE SA:s in active state for a peer */
|
||||
Ipcom_hash *peer_addr_hash_table;
|
||||
|
||||
/* Hash tables with the most recent IKE SA:s in active state for a peer */
|
||||
Ipcom_hash *peer_id_hash_table;
|
||||
|
||||
/* Hash table with IKE SA:s in constructing state */
|
||||
Ipcom_hash *constructing_peer_addr_hash_table;
|
||||
}
|
||||
Ipike_sadb;
|
||||
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* Ipike_ipsec_sadb
|
||||
*===========================================================================
|
||||
*/
|
||||
typedef struct Ipike_ipsec_sadb_struct
|
||||
{
|
||||
Ip_bool initialized;
|
||||
|
||||
/* Hash tables with all CHILD SA:s */
|
||||
Ipcom_hash *child_hash_table;
|
||||
|
||||
/* Hash tables with active IPSec SA:s created from a specific configuration section */
|
||||
Ipcom_hash *section_hash_table;
|
||||
}
|
||||
Ipike_ipsec_sadb;
|
||||
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* Ipike_pfkeyv2
|
||||
*===========================================================================
|
||||
*/
|
||||
typedef struct Ipike_pfkeyv2_struct
|
||||
{
|
||||
Ip_bool initialized;
|
||||
/* The UDP socket to listen for PF_KEY messages on */
|
||||
Ip_fd sock;
|
||||
/* The callback to use when a IPSec SA expires */
|
||||
Ipike_sa_expire_cb sa_expire_cb;
|
||||
/* The callback to use when IPSec need a new SA */
|
||||
Ipike_sa_acquire_cb sa_acquire_cb;
|
||||
/* The callback to use when IPSec SA is deleted */
|
||||
Ipike_sa_remove_cb sa_remove_cb;
|
||||
/* The callback to use when all IPSec SA is flushed */
|
||||
Ipike_sa_flush_cb sa_flush_cb;
|
||||
}
|
||||
Ipike_pfkeyv2;
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* Ipike_radius
|
||||
*===========================================================================
|
||||
*/
|
||||
typedef struct Ipike_radius_struct
|
||||
{
|
||||
Ip_bool initialized;
|
||||
/* Hash tables with ongoing radius communication */
|
||||
Ipcom_hash* hash_table;
|
||||
/* Hash table with unique id's */
|
||||
Ipcom_hash* unique_id_table;
|
||||
}
|
||||
Ipike_radius;
|
||||
|
||||
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* Ipike_data
|
||||
*===========================================================================
|
||||
*/
|
||||
typedef struct Ipike_data_struct
|
||||
{
|
||||
Ipcom_atomic_t initialized;
|
||||
Ip_u8 version_min; /* Minimum supported major version */
|
||||
Ip_u8 version_max; /* Maximum supported major version */
|
||||
|
||||
/* Timout list (second timeout and liveness timeout) */
|
||||
Ipcom_pqueue* tmo_head;
|
||||
Ipcom_tmo2 housekeep_tmo;
|
||||
|
||||
Ip_u16 port;
|
||||
Ip_u16 port_nat;
|
||||
Ip_u16 keepalive_nat;
|
||||
Ip_u16 liveness_timer_resolution;
|
||||
Ip_u16 rekey_fuzz;
|
||||
Ip_u16 http_request_timeout;
|
||||
|
||||
/* The IKE daemon process pid */
|
||||
Ip_pid_t pid;
|
||||
|
||||
/* The IPD control socket */
|
||||
Ip_fd ipd;
|
||||
/* Set require_cookie to TRUE if responder require a cookie notify to
|
||||
* verify a real request. */
|
||||
Ip_bool require_cookie;
|
||||
|
||||
/* Allow certificates to be fetched via HTTP */
|
||||
Ip_bool use_hash_and_url;
|
||||
|
||||
/* Initiate rekey for IPSec SA key for passive connections. */
|
||||
Ip_bool rekey_passive;
|
||||
|
||||
/* Read/Write data */
|
||||
Ipike_config_ike config;
|
||||
Ipike_dispatcher disp;
|
||||
Ipike_isakmp isakmp;
|
||||
Ipike_sadb sadb;
|
||||
Ipike_ipsec_sadb ipsec_sadb;
|
||||
Ipike_pfkeyv2 pfkeyv2;
|
||||
Ipike_radius radius;
|
||||
|
||||
/* Number of active IPSec SAs */
|
||||
Ip_u32 active_inbound_ipsec_sa;
|
||||
|
||||
/* Number of active ISAKMP exchanges */
|
||||
Ip_u32 active_exchanges;
|
||||
|
||||
/* The maximum number of concurrent IKE SAs */
|
||||
Ip_u32 max_ike_sa_num;
|
||||
|
||||
/* The number of IKE SAs */
|
||||
Ip_u32 ike_sa_num;
|
||||
|
||||
/* The maximum number of concurrent IPsec SAs */
|
||||
Ip_u32 max_ipsec_sa_num;
|
||||
|
||||
/* The number of IPsec SAs */
|
||||
Ip_u32 ipsec_sa_num;
|
||||
|
||||
/* The maximum size of an IKE message */
|
||||
Ip_u32 max_ike_message_size;
|
||||
|
||||
/* This variable is used for performance testing */
|
||||
Ip_bool running_performance_test;
|
||||
|
||||
/* This variable is used to allow duplicate IKE SAs to be created */
|
||||
Ip_bool allow_duplicate_ike_sa;
|
||||
|
||||
/* This variable is used to temporary paus initiating of new IPSec SA */
|
||||
Ip_bool paus_init_ipsec_sa;
|
||||
|
||||
/* This variable is used to create a traffic selector matching any responder address */
|
||||
Ip_bool dynamic_ip_anyflow;
|
||||
|
||||
/* This variable is used to add the dynamic address as a home address */
|
||||
Ip_bool dynamic_ip_homeaddr;
|
||||
|
||||
/* Enables strict lifetime policy, IKEv1 only */
|
||||
Ip_bool strict_lifetime_policy;
|
||||
|
||||
/* Statistic variables */
|
||||
struct Ip_timeval start;
|
||||
|
||||
/* Schedule shutdown */
|
||||
Ip_bool schedule_shutdown;
|
||||
|
||||
/* Mutex to protect IPIKE global data. */
|
||||
Ip_bool code_lock_initialized;
|
||||
Ipcom_mutex code_mutex;
|
||||
#if defined (IP_ASSERT) && !defined(IP_PORT_LKM) && !defined(IP_PORT_VXWORKS)
|
||||
int code_mutex_count;
|
||||
Ip_pid_t code_lock_owner;
|
||||
#endif
|
||||
|
||||
#ifdef IPIKE_USE_EVENT_LOG
|
||||
Ipike_channel_server *event_server;
|
||||
#endif
|
||||
/* Callbacks */
|
||||
|
||||
/*
|
||||
*===========================================================================
|
||||
* key_password_cb
|
||||
*===========================================================================
|
||||
* Description: Returns the password for the private key.
|
||||
* Parameters: buf - The buffer to which the password should be copied
|
||||
* size - The maximum size of the password buffer.
|
||||
* rwflag -
|
||||
* filename - The filename of the private key file.
|
||||
* Returns: The length of the password.
|
||||
*
|
||||
*/
|
||||
int (*key_password_cb)(char *buf, int size, int rwflag, void *filename);
|
||||
|
||||
/* Read only data */
|
||||
const Ipike_string_int_map *authentication_method_map;
|
||||
const Ipike_string_int_map *v2_authentication_method_map;
|
||||
const Ipike_string_int_map *encryption_algorithm_map;
|
||||
const Ipike_string_int_map *v2_encryption_algorithm_map;
|
||||
const Ipike_string_int_map *encryption_algorithm_map2;
|
||||
const Ipike_string_int_map *v2_encryption_algorithm_map2;
|
||||
const Ipike_string_int_map *hash_algorithm_map;
|
||||
const Ipike_string_int_map *dh_group_map;
|
||||
const Ipike_string_int_map *life_type_map;
|
||||
const Ipike_string_int_map *encapsulation_mode_map;
|
||||
const Ipike_string_int_map *authentication_algorithm_map;
|
||||
const Ipike_string_int_map *doi_map;
|
||||
const Ipike_string_int_map *exchange_map;
|
||||
const Ipike_string_int_map *payload_map;
|
||||
const Ipike_string_int_map *notify_map;
|
||||
const Ipike_string_int_map *cp_type_map;
|
||||
const Ipike_string_int_map *cp_attr_map;
|
||||
const Ipike_string_int_map *id_type_map;
|
||||
const Ipike_string_int_map *id_proto_map;
|
||||
const Ipike_string_int_map *proposal_proto_map;
|
||||
const Ipike_string_int_map *transform_type_map;
|
||||
const Ipike_string_int_map *transform_encr_id_map;
|
||||
const Ipike_string_int_map *transform_prf_id_map;
|
||||
const Ipike_string_int_map *transform_integ_id_map;
|
||||
const Ipike_string_int_map *transform_dh_id_map;
|
||||
const Ipike_string_int_map *isakmp_trans_id_map;
|
||||
const Ipike_string_int_map *ipsec_ah_trans_id_map;
|
||||
const Ipike_string_int_map *ipsec_esp_trans_id_map;
|
||||
const Ipike_string_int_map *ipsec_esp_key_length_map;
|
||||
const Ipike_string_int_map *ipsec_ipcomp_trans_id_map;
|
||||
const Ipike_string_int_map *cert_encode_type_map;
|
||||
const Ipike_string_int_map *x509_verify_err_map;
|
||||
const Ipike_string_int_map *eap_code_map;
|
||||
const Ipike_string_int_map *rohc_map;
|
||||
|
||||
char addr_buf[64];
|
||||
}
|
||||
Ipike_data;
|
||||
|
||||
#ifdef IPIKE_USE_PERF_EVAL
|
||||
|
||||
#define IPIKE_PHASE1 0
|
||||
#define IPIKE_PHASE2 1
|
||||
|
||||
typedef struct Ipike_exchange_stats_struct
|
||||
{
|
||||
struct Ip_timeval ok_time;
|
||||
struct Ip_timeval nok_time;
|
||||
unsigned int ok_count;
|
||||
unsigned int nok_count;
|
||||
|
||||
}Ipike_exchange_stats;
|
||||
|
||||
typedef struct Ipike_perf_struct
|
||||
{
|
||||
|
||||
/* 5 IKEv1 exchange types supported */
|
||||
Ipike_exchange_stats v1_stat[5];
|
||||
/* 3 IKEv2 exchange types supported */
|
||||
Ipike_exchange_stats v2_stat[3];
|
||||
|
||||
/* Rekey stats */
|
||||
/* As of now only phase 2 rekey is valid */
|
||||
Ipike_exchange_stats v1_rekey[2];
|
||||
Ipike_exchange_stats v2_rekey[2];
|
||||
|
||||
}Ipike_perf;
|
||||
|
||||
/* YYAGII: Yck! Yet another global in IKE! */
|
||||
IP_EXTERN Ipike_perf ipike_perf;
|
||||
|
||||
#endif /* #ifdef IPIKE_USE_PERF_EVAL */
|
||||
|
||||
IP_EXTERN Ipike_data ipike;
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* 6 FUNCTIONS
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
IP_GLOBAL Ipike_error
|
||||
ipike_process_ipd_msg(Ip_fd ipd_sock);
|
||||
|
||||
IP_GLOBAL int
|
||||
ipike_cmd(int argc, char** argv);
|
||||
|
||||
IP_GLOBAL const char *
|
||||
ipike_version_number(void);
|
||||
|
||||
IP_PUBLIC const char *
|
||||
ipike_version(void);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
****************************************************************************
|
||||
* END OF FILE
|
||||
****************************************************************************
|
||||
*/
|
||||
Reference in New Issue
Block a user