/* ****************************************************************************** * HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_h.h,v $ $Revision: 1.47.10.5 $ * $Source: /home/interpeak/CVSRoot/ipike/src/ipike_h.h,v $ * $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Kenneth Jonsson ****************************************************************************** */ #ifndef IPIKE_H_H #define IPIKE_H_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ #include "ipike_config.h" /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #if defined(IPCRYPTO) && !defined(IPCOM_USE_CLIB_PROTO) #define IPCOM_USE_CLIB_PROTO #endif #include #include #include #include #include #include #include "ipike_util.h" #include "ipike_configuration.h" #include "ipike_pfkeyv2.h" #ifdef IPIKE_USE_EVENT_LOG #include "ipike_event_server.h" /* Set event logging function before including ipike_event_log.h */ #define IPIKE_EVENT_LOG_FUNC ipike_event_server_log #endif #include "ipike_event_log.h" #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ /* Support IKE version 1 protocol. Disable of IKE v1 not fullt implemented * yet, so this define MUST be set */ #define IPIKE_USE_VERSION1 1 /* The name this service is using in the IPD machinery */ #define IPIKE_IPD_NAME "ipike" /* The name of the IKE daemon process */ #define IPIKE_PROC_NAME "ipiked" /* The name of the IKE control command */ #define IPIKE_CMD_NAME "ike" #define IPIKE_FREEP(p) do { ipcom_free((void *)p); p = IP_NULL; } while (0) #ifdef IPIKE_USE_PKTINFO #define IPIKE_PKT_CLEN 128 #else #define IPIKE_PKT_CLEN 0 #endif /* Mobility update related error messages */ #define IPIKE_MOBIKE_UPDATE_INITIATED 0 #define IPIKE_MOBIKE_INVALID_ADDRESS 1 #define IPIKE_MOBIKE_SIMILAR_ADDRESS 2 #define IPIKE_MOBIKE_LISTEN_NEW_FAILED 3 #define IPIKE_MOBIKE_UPDATE_FAILED 4 /* IKE MIP comm protocol msg types */ #define IPIKE_MOBIKE_UPDATE_LOCAL 0 #define IPIKE_MOBIKE_UPDATE_REMOTE 1 /* Not used currently */ #define IPIKE_MOBIKE_DYNAMIC_ADDRESS 2 /* *=========================================================================== * syslog *=========================================================================== */ #define IPCOM_SYSLOG_PRIORITY IPIKE_SYSLOG_PRIORITY #define IPCOM_SYSLOG_FACILITY IPCOM_LOG_IPIKE #ifdef IPCOM_USE_INET6 #define IPIKE_ADDRSTRLEN IP_INET6_ADDRSTRLEN #else #define IPIKE_ADDRSTRLEN IP_INET_ADDRSTRLEN #endif /* *=========================================================================== * code lock *=========================================================================== */ #define IPIKE_CODE_LOCK_INIT() if (ipike.code_lock_initialized == 0) \ if (ipcom_mutex_create(&ipike.code_mutex) == 0) \ ipike.code_lock_initialized = 1; #define IPIKE_CODE_LOCK_INITIALIZED() (ipike.code_lock_initialized == 1) #define IPIKE_CODE_LOCK_DESTROY() \ if (IPIKE_CODE_LOCK_INITIALIZED()) \ do { \ ipike.code_lock_initialized = 0; \ ipcom_mutex_delete(&ipike.code_mutex); \ } while(0) #if defined (IP_ASSERT) && !defined(IP_PORT_LKM) && !defined(IP_PORT_VXWORKS) #define IPIKE_CODE_ISLOCKED() if (IPIKE_CODE_LOCK_INITIALIZED()) \ ip_assert(ipike.code_mutex_count == 1) #define IPIKE_CODE_LOCK() if (!IPIKE_CODE_LOCK_INITIALIZED()) \ IPIKE_CODE_LOCK_INIT(); \ if (IPIKE_CODE_LOCK_INITIALIZED()) { \ do { \ ipcom_mutex_lock(ipike.code_mutex); \ ipike.code_lock_owner = ipcom_getpid(); \ ip_assert(ipike.code_mutex_count == 0); \ ipike.code_mutex_count++; \ } while((0)); \ } #define IPIKE_CODE_UNLOCK() if IPIKE_CODE_LOCK_INITIALIZED() { \ do { \ ip_assert(ipike.code_lock_owner == ipcom_getpid()); \ ip_assert(ipike.code_mutex_count == 1); \ ipike.code_mutex_count--; \ ipike.code_lock_owner = 0; \ ipcom_mutex_unlock(ipike.code_mutex); \ } while((0)); \ } #else #define IPIKE_CODE_ISLOCKED() IP_NOOP #define IPIKE_CODE_LOCK() if (!IPIKE_CODE_LOCK_INITIALIZED()) \ IPIKE_CODE_LOCK_INIT(); \ if (IPIKE_CODE_LOCK_INITIALIZED()) \ ipcom_mutex_lock(ipike.code_mutex) #define IPIKE_CODE_UNLOCK() if IPIKE_CODE_LOCK_INITIALIZED() \ ipcom_mutex_unlock(ipike.code_mutex) #endif #define IPIKE_IKE_SA_REACHED_LIMIT() \ ((ipike.max_ike_sa_num != 0 && ipike.ike_sa_num >= ipike.max_ike_sa_num)) #define IPIKE_IPSEC_SA_REACHED_LIMIT() \ ((ipike.max_ipsec_sa_num != 0 && ipike.ipsec_sa_num >= ipike.max_ipsec_sa_num)) #define IPIKE_FLOW_TYPE_ACQUIRE 12 #define IPIKE_FLOW_TYPE_REQUIRE 13 /* **************************************************************************** * 5 TYPES **************************************************************************** */ /* *=========================================================================== * Ipike_socket *=========================================================================== */ typedef struct Ipike_socket_struct { Ipcom_list list; union Ip_sockaddr_union addr; Ip_fd fd; } Ipike_socket; /* *=========================================================================== * Ipike_flowtype_flow *=========================================================================== */ typedef struct Ipike_flowtype_flow { Ipcom_list list; Ipike_config_flow flow; Ip_u8 flowtype; } Ipike_flowtype_flow; /* *=========================================================================== * Ipike_dispatcher *=========================================================================== */ typedef struct Ipike_dispatcher_struct { Ip_bool initialized; Ipcom_atomic_t reconfigure; Ipcom_list sockets; /* List of listening IKE (UDP) sockets */ Ipcom_list flowtype_flows; /* List of 'require' or 'acquire' flows */ /* The UDP socket to listen for Radius messages on. */ #ifdef IPIKE_USE_RADIUS Ip_fd* sock_radius; Ip_u32 sock_radius_count; Ip_u32 sock_radius_count_max; #endif /* Socket waiting for IKE SA dump requests */ Ip_fd shell_cmd_sock; /* Ticks, used to determine when houskeeping should be performed */ int ticks; /* Buffer where data can (temporarily) be stored */ Ip_size_t recv_buf_len; void * recv_buf; } Ipike_dispatcher; /* *=========================================================================== * Ipike_isakmp *=========================================================================== */ typedef struct Ipike_isakmp_struct { Ip_bool initialized; /* Hash tables with on-going ISAKMP exchanges */ Ipcom_hash* exchange_hash_table_cookie; Ipcom_hash* exchange_hash_table_spi; Ipcom_hash* exchange_hash_table_id; } Ipike_isakmp; /* *=========================================================================== * Ipike_sadb *=========================================================================== */ typedef struct Ipike_sadb_struct { Ip_bool initialized; /* Hash tables with IKE SA:s in constructing and active state */ Ipcom_hash *cookie_hash_table; /* Hash tables with the most recent IKE SA:s in active state for a peer */ Ipcom_hash *peer_addr_hash_table; /* Hash tables with the most recent IKE SA:s in active state for a peer */ Ipcom_hash *peer_id_hash_table; /* Hash table with IKE SA:s in constructing state */ Ipcom_hash *constructing_peer_addr_hash_table; } Ipike_sadb; /* *=========================================================================== * Ipike_ipsec_sadb *=========================================================================== */ typedef struct Ipike_ipsec_sadb_struct { Ip_bool initialized; /* Hash tables with all CHILD SA:s */ Ipcom_hash *child_hash_table; /* Hash tables with active IPSec SA:s created from a specific configuration section */ Ipcom_hash *section_hash_table; } Ipike_ipsec_sadb; /* *=========================================================================== * Ipike_pfkeyv2 *=========================================================================== */ typedef struct Ipike_pfkeyv2_struct { Ip_bool initialized; /* The UDP socket to listen for PF_KEY messages on */ Ip_fd sock; /* The callback to use when a IPSec SA expires */ Ipike_sa_expire_cb sa_expire_cb; /* The callback to use when IPSec need a new SA */ Ipike_sa_acquire_cb sa_acquire_cb; /* The callback to use when IPSec SA is deleted */ Ipike_sa_remove_cb sa_remove_cb; /* The callback to use when all IPSec SA is flushed */ Ipike_sa_flush_cb sa_flush_cb; } Ipike_pfkeyv2; /* *=========================================================================== * Ipike_radius *=========================================================================== */ typedef struct Ipike_radius_struct { Ip_bool initialized; /* Hash tables with ongoing radius communication */ Ipcom_hash* hash_table; /* Hash table with unique id's */ Ipcom_hash* unique_id_table; } Ipike_radius; /* *=========================================================================== * Ipike_data *=========================================================================== */ typedef struct Ipike_data_struct { Ipcom_atomic_t initialized; Ip_u8 version_min; /* Minimum supported major version */ Ip_u8 version_max; /* Maximum supported major version */ /* Timout list (second timeout and liveness timeout) */ Ipcom_pqueue* tmo_head; Ipcom_tmo2 housekeep_tmo; Ip_u16 port; Ip_u16 port_nat; Ip_u16 keepalive_nat; Ip_u16 liveness_timer_resolution; Ip_u16 rekey_fuzz; Ip_u16 http_request_timeout; /* The IKE daemon process pid */ Ip_pid_t pid; /* The IPD control socket */ Ip_fd ipd; /* Set require_cookie to TRUE if responder require a cookie notify to * verify a real request. */ Ip_bool require_cookie; /* Allow certificates to be fetched via HTTP */ Ip_bool use_hash_and_url; /* Initiate rekey for IPSec SA key for passive connections. */ Ip_bool rekey_passive; /* Read/Write data */ Ipike_config_ike config; Ipike_dispatcher disp; Ipike_isakmp isakmp; Ipike_sadb sadb; Ipike_ipsec_sadb ipsec_sadb; Ipike_pfkeyv2 pfkeyv2; Ipike_radius radius; /* Number of active IPSec SAs */ Ip_u32 active_inbound_ipsec_sa; /* Number of active ISAKMP exchanges */ Ip_u32 active_exchanges; /* The maximum number of concurrent IKE SAs */ Ip_u32 max_ike_sa_num; /* The number of IKE SAs */ Ip_u32 ike_sa_num; /* The maximum number of concurrent IPsec SAs */ Ip_u32 max_ipsec_sa_num; /* The number of IPsec SAs */ Ip_u32 ipsec_sa_num; /* The maximum size of an IKE message */ Ip_u32 max_ike_message_size; /* This variable is used for performance testing */ Ip_bool running_performance_test; /* This variable is used to allow duplicate IKE SAs to be created */ Ip_bool allow_duplicate_ike_sa; /* This variable is used to temporary paus initiating of new IPSec SA */ Ip_bool paus_init_ipsec_sa; /* This variable is used to create a traffic selector matching any responder address */ Ip_bool dynamic_ip_anyflow; /* This variable is used to add the dynamic address as a home address */ Ip_bool dynamic_ip_homeaddr; /* Enables strict lifetime policy, IKEv1 only */ Ip_bool strict_lifetime_policy; /* Statistic variables */ struct Ip_timeval start; /* Schedule shutdown */ Ip_bool schedule_shutdown; /* Mutex to protect IPIKE global data. */ Ip_bool code_lock_initialized; Ipcom_mutex code_mutex; #if defined (IP_ASSERT) && !defined(IP_PORT_LKM) && !defined(IP_PORT_VXWORKS) int code_mutex_count; Ip_pid_t code_lock_owner; #endif #ifdef IPIKE_USE_EVENT_LOG Ipike_channel_server *event_server; #endif /* Callbacks */ /* *=========================================================================== * key_password_cb *=========================================================================== * Description: Returns the password for the private key. * Parameters: buf - The buffer to which the password should be copied * size - The maximum size of the password buffer. * rwflag - * filename - The filename of the private key file. * Returns: The length of the password. * */ int (*key_password_cb)(char *buf, int size, int rwflag, void *filename); /* Read only data */ const Ipike_string_int_map *authentication_method_map; const Ipike_string_int_map *v2_authentication_method_map; const Ipike_string_int_map *encryption_algorithm_map; const Ipike_string_int_map *v2_encryption_algorithm_map; const Ipike_string_int_map *encryption_algorithm_map2; const Ipike_string_int_map *v2_encryption_algorithm_map2; const Ipike_string_int_map *hash_algorithm_map; const Ipike_string_int_map *dh_group_map; const Ipike_string_int_map *life_type_map; const Ipike_string_int_map *encapsulation_mode_map; const Ipike_string_int_map *authentication_algorithm_map; const Ipike_string_int_map *doi_map; const Ipike_string_int_map *exchange_map; const Ipike_string_int_map *payload_map; const Ipike_string_int_map *notify_map; const Ipike_string_int_map *cp_type_map; const Ipike_string_int_map *cp_attr_map; const Ipike_string_int_map *id_type_map; const Ipike_string_int_map *id_proto_map; const Ipike_string_int_map *proposal_proto_map; const Ipike_string_int_map *transform_type_map; const Ipike_string_int_map *transform_encr_id_map; const Ipike_string_int_map *transform_prf_id_map; const Ipike_string_int_map *transform_integ_id_map; const Ipike_string_int_map *transform_dh_id_map; const Ipike_string_int_map *isakmp_trans_id_map; const Ipike_string_int_map *ipsec_ah_trans_id_map; const Ipike_string_int_map *ipsec_esp_trans_id_map; const Ipike_string_int_map *ipsec_esp_key_length_map; const Ipike_string_int_map *ipsec_ipcomp_trans_id_map; const Ipike_string_int_map *cert_encode_type_map; const Ipike_string_int_map *x509_verify_err_map; const Ipike_string_int_map *eap_code_map; const Ipike_string_int_map *rohc_map; char addr_buf[64]; } Ipike_data; #ifdef IPIKE_USE_PERF_EVAL #define IPIKE_PHASE1 0 #define IPIKE_PHASE2 1 typedef struct Ipike_exchange_stats_struct { struct Ip_timeval ok_time; struct Ip_timeval nok_time; unsigned int ok_count; unsigned int nok_count; }Ipike_exchange_stats; typedef struct Ipike_perf_struct { /* 5 IKEv1 exchange types supported */ Ipike_exchange_stats v1_stat[5]; /* 3 IKEv2 exchange types supported */ Ipike_exchange_stats v2_stat[3]; /* Rekey stats */ /* As of now only phase 2 rekey is valid */ Ipike_exchange_stats v1_rekey[2]; Ipike_exchange_stats v2_rekey[2]; }Ipike_perf; /* YYAGII: Yck! Yet another global in IKE! */ IP_EXTERN Ipike_perf ipike_perf; #endif /* #ifdef IPIKE_USE_PERF_EVAL */ IP_EXTERN Ipike_data ipike; /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ IP_GLOBAL Ipike_error ipike_process_ipd_msg(Ip_fd ipd_sock); IP_GLOBAL int ipike_cmd(int argc, char** argv); IP_GLOBAL const char * ipike_version_number(void); IP_PUBLIC const char * ipike_version(void); #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */