/* ****************************************************************************** * HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_config.h,v $ $Revision: 1.34.10.7 $ * $Source: /home/interpeak/CVSRoot/ipike/config/ipike_config.h,v $ * $Author: svc-cmnet $ $Date: 2013-03-13 07:45:25 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Kenneth Jonsson ****************************************************************************** */ #ifndef IPIKE_CONFIG_H #define IPIKE_CONFIG_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* Defines for IPIKE */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 CONFIGURATION **************************************************************************** */ /* *=========================================================================== * IPIKE_USE_VERSION2 *=========================================================================== * Set define to enable IKE version2 protocol. */ #define IPIKE_USE_VERSION2 /* *=========================================================================== * IPIKE_USE_EAP *=========================================================================== * Set define to enable EAP authentication mechanism for IKE version2 * protocol. */ #if defined(IPIKE_USE_VERSION2) && defined(IPEAP) #define IPIKE_USE_EAP #endif /* *=========================================================================== * IPIKE_USE_RADIUS *=========================================================================== * Set define to enable Radius. This define is needed for responder (EAP * Supplicant) when running EAP authentication mechanism for IKE version2. */ #if defined(IPIKE_USE_EAP) && defined(IPRADIUS) #define IPIKE_USE_RADIUS #endif /* *=========================================================================== * IPIKE_USE_ROHC *=========================================================================== * Set define to enable ROHC parameter negotiation using IKEV2. */ #if defined(IPIKE_USE_VERSION2) && defined(IPROHC) #define IPIKE_USE_ROHC #endif /* *=========================================================================== * IPIKE_USE_AGGRESSIVE_MODE *=========================================================================== * Set define to enable aggressive mode negotiation for IKE version1 * protocol. */ #define IPIKE_USE_AGGRESSIVE_MODE /* *=========================================================================== * IPIKE_REAUTH_MARGIN_SEC *=========================================================================== * The number of seconds before the IKE SA expires that reauthentication * should take place. */ #define IPIKE_REAUTH_MARGIN_SEC 20 /* *=========================================================================== * IPIKE_REKEY_MARGIN_SEC *=========================================================================== * The number of seconds before the IKE SA expires that rekey should take * place. Let rekey have some advantage compared to reauthentication by * doubling the margin. */ #define IPIKE_REKEY_MARGIN_SEC (IPIKE_REAUTH_MARGIN_SEC + IPIKE_REAUTH_MARGIN_SEC) /* *=========================================================================== * IPIKE_REKEY_RETRY_TIMEOUT_MS *=========================================================================== * The number of milliseconds to wait before retrying a rekey when the * IKE SA is busy (exchange in progress). This timeout is also used for the * same purpose when performing a reauhtentication. */ #define IPIKE_REKEY_RETRY_TIMEOUT_MS 1000 /* *=========================================================================== * IPIKE_USE_CRYPTO_TEST *=========================================================================== * Enable crypto self test on startup */ #if defined(IP_DEBUG) && defined(IPIKE_USE_VERSION2) #define IPIKE_USE_CRYPTO_SELF_TEST #endif /* *=========================================================================== * IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS *=========================================================================== * The number of milliseconds to wait before retrying a INFORMATION exchange when the * IKE SA is busy (exchange in progress). */ #define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS 1000 /* *=========================================================================== * IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE *=========================================================================== * when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue. * The default size of queue is 10. */ #define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE 10 /* *=========================================================================== * IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS *=========================================================================== * The number of milliseconds to wait before retrying a INFORMATION exchange when the * IKE SA is busy (exchange in progress). */ #define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS 1000 /* *=========================================================================== * IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE *=========================================================================== * when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue. * The default size of queue is 10. */ #define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE 10 /* *=========================================================================== * IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND *=========================================================================== * The ISAKMPD (on OpenBSD) will not allow that the key length is transmitted * in the payloads during phase 1 or phase2. It will also consider the key * length to be 256 bits during phase1 and 128 bits during phase 2. * * NOTE: This define will result in a bug, since there is no default for AES, * at least not during phase 1. */ /*#define IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND*/ /* *=========================================================================== * IPIKE_USE_AES_MAC *=========================================================================== * */ #if !defined(OPENSSL_NO_AES) && defined(IPCRYPTO) #define IPIKE_USE_AES_MAC #endif /* *=========================================================================== * IPCOM_SYSLOG_PRIORITY *=========================================================================== * Default syslog priority. */ #if defined(_WRS_CONFIG_IPIKE_SYSLOG_PRIORITY) #define IPIKE_SYSLOG_PRIORITY _WRS_CONFIG_IPIKE_SYSLOG_PRIORITY #else #define IPIKE_SYSLOG_PRIORITY IPCOM_SYSLOG_PRIO_DEFAULT #endif /* *=========================================================================== * IPIKE_USE_PKTINFO *=========================================================================== * Use PKTINFO processing to be able to listen on :: or 0.0.0.0. * Can be only used if IPNET is defined */ #if defined(IPNET) #define IPIKE_USE_PKTINFO #endif /* *=========================================================================== * IPIKE_USE_MIGRATE *=========================================================================== * Define to enable pfkey migrate support for MIP daemons. * Is dependent on pfkey defines in IPIPSEC and complaint behavior * from MIP daemons. * Currently IKE and IPSEC does not handle the MIGRATE messages */ /* #define IPIKE_USE_MIGRATE */ /* *=========================================================================== * IPIKE_USE_PERF_EVAL *=========================================================================== * Performance evaluation code for IKEv1 and v2 * */ #define IPIKE_USE_PERF_EVAL /* *=========================================================================== * IPIKE_USE_OCSP *=========================================================================== * Use OCSP req/responses to verify certificate validity status * */ #if !defined(OPENSSL_NO_OCSP) && defined(IPCRYPTO) #define IPIKE_USE_OCSP #endif /* *=========================================================================== * IPIKE_DPD_WINDOW_SIZE *=========================================================================== * For IKEv1 only. This setting specifies the size of the DPD window which * contains acceptable sequence numbers. * */ #define IPIKE_DPD_WINDOW_SIZE 10 /* *=========================================================================== * IPIKE_IKEV2_MAX_EXCH_IN_NEG *=========================================================================== * For IKEv2 only. This setting specifies the maximum number of exchanges * that is allowed to complete an IKEv2 negotiation. An IKEv2 negotiation is * normally completed within 2 exchanges (one INIT and one AUTH) but if EAP * is used as authentication method more exchanges are required. One exchange * consists of one request-response message pair. * */ #define IPIKE_IKEV2_MAX_EXCH_IN_NEG 15 /* *=========================================================================== * IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD *=========================================================================== * If two or more IKE SAs from the same remote peer are established within * this period of seconds they will be treated as a simultaneous (collision) * exchange and the IKE SA containing the smallest nonce will be removed. * */ #define IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD 1 /* *=========================================================================== * IPIKE_DISPATCHER_RECEIVE_RETRIES *=========================================================================== * Number of times the IKE dispatcher will tolerate receive errors before * it reconfigures itself (re-open listening UDP sockets) * */ #define IPIKE_DISPATCHER_RECEIVE_RETRIES 3 /* *=========================================================================== * IPIKE_USE_EVENT_LOG *=========================================================================== * IKE Event logging. Each type of log event can be explicitly be removed * at compile time by either removing the corresponding define below or * by adding a #undef directive. Some of these events are triggered in the * IPsec module and some in the IPIKE module. Events triggered from IPsec * are sent to the IKE daemon via pfkeyv2 and then relayed to registered * event receivers * */ #ifdef _WRS_CONFIG_COMPONENT_IPIKE_USE_EVENT_LOG /* Global switch, enables event logging */ #define IPIKE_USE_EVENT_LOG #endif #ifdef IPIKE_USE_EVENT_LOG /* * Log events, enable/disable specific log events here at compile time. By * default all is turned on. */ /* Phase 2 hard lifesize expired */ #define IPIKE_USE_EVENT_HARD_LIFE_SIZE_EXPIRED /* Phase 2 hard lifetime expired */ #define IPIKE_USE_EVENT_HARD_LIFE_TIME_EXPIRED /* An IKE packet was discarded */ #define IPIKE_USE_EVENT_IKE_PACKET_DISCARD /* Phase 1 (IKE SA) negotiation failed */ #define IPIKE_USE_EVENT_IKE_PHASE_I_FAIL /* Phase 1 (IKE SA) negotiation completed successfully */ #define IPIKE_USE_EVENT_IKE_PHASE_I_SUCCESS /* Phase 2 (IPsec SA) negotiation failed */ #define IPIKE_USE_EVENT_IKE_PHASE_II_FAIL /* Phase 2 (IPsec SA) negotiation completed */ #define IPIKE_USE_EVENT_IKE_PHASE_II_SUCCESS /* IPsec packet was discarded */ #define IPIKE_USE_EVENT_IPSEC_PACKET_DISCARD /* IPsec SA sequence number overflowed or rolled over */ #define IPIKE_USE_EVENT_SEQUENCE_NUM_OVERFLOW /* Phase 2 (IPsec SA) soft lifetime in bytes expired */ #define IPIKE_USE_EVENT_SOFT_LIFE_SIZE_EXPIRED /* Phase 2 (IPsec SA) soft lifetime in time expired */ #define IPIKE_USE_EVENT_SOFT_LIFE_TIME_EXPIRED /* An SPD packet was discarded */ #define IPIKE_USE_EVENT_SPD_PACKET_DISCARD #endif /* IPIKE_USE_EVENT_LOG */ /* *=========================================================================== * IPIKE_CONFIG_ROHC_INTEG_NUM_MAX *=========================================================================== * The maximum number of integrity algorithms that can be configured and * proposed when ROHC is enabled */ #define IPIKE_CONFIG_ROHC_INTEG_NUM_MAX 7 /* *=========================================================================== * IPIKE_CONFIG_ROHC_INTEG_NUM_MAX *=========================================================================== * The maximum number of ROHC profiles that can be configured. */ #define IPIKE_CONFIG_ROHC_PROFILE_NUM_MAX 8 /* *=========================================================================== * IPIKE_ROHC_IFNAME_SIZE *=========================================================================== * ROHC Interface name sizes */ #define IPIKE_ROHC_IFNAME_SIZE 16 #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */