/* ****************************************************************************** * INTERPEAK CONFIGURATION SOURCE FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_config.c,v $ $Revision: 1.27.2.6 $ * $Source: /home/interpeak/CVSRoot/ipike/config/ipike_config.c,v $ * $Author: svc-cmnet $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Kenneth Jonsson ****************************************************************************** */ /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* **************************************************************************** * 2 INCLUDE FILES **************************************************************************** */ #include "ipike_config.h" #define IPCOM_USE_CLIB_PROTO #include #include #include #include #include #include /* **************************************************************************** * 3 DEFINES **************************************************************************** */ /* **************************************************************************** * 4 TYPES **************************************************************************** */ /* **************************************************************************** * 5 EXTERN PROTOTYPES **************************************************************************** */ /* *=========================================================================== * ipike_configure *=========================================================================== */ IP_PUBLIC Ip_err ipike_configure(void); /* **************************************************************************** * 6 LOCAL PROTOTYPES **************************************************************************** */ /* **************************************************************************** * 7 DATA **************************************************************************** */ /* *=========================================================================== * SYSTEM VARIABLES *=========================================================================== */ IP_CONST Ipcom_sysvar ipike_conf_sysvar[] = { /* ISAKMP socket buffer size (in bytes), this is the largest ISAKMP message the IKE daemon can send and receive */ IP_SYSVAR("ipike.isakmp_sock_buf_size", "10000", IPIKE_SOCK_BUF_SIZE), /* The maximum number of active exchanges, ISAKMP packets for new exchanges will be dropped when the maximum is reached. Set to 0 to allow infinite number of exchanges. */ IP_SYSVAR("ipike.isakmp_max_exchanges", "32", IPIKE_MAX_EXCHANGES), /* The maximum size of an ISAKMP packet. Note that all IKEv2 implementations MUST be able to send, receive, and process IKE messages that are up to 1280 octets long, and they SHOULD be able to send, receive, and process messages that are up to 3000 octets long. Set to 0 for unlimited (max UDP packet size) */ IP_SYSVAR("ipike.max_message_size", "0", IPIKE_MAX_MESSAGE_SIZE), /* The maximum number of IKE SAs that are allowed to be established * at the same time. New negotiations will be rejected when this limit * is reached. Set to 0 for no restrictions */ IP_SYSVAR("ipike.max_ike_sa_num", "0", IPIKE_MAX_IKE_SA_NUM), /* The maximum number of IPsec SAs that are allowed to be established * at the same time. New requests will be rejected when this limit * is reached. Note that IPsec SAs are intalled in pairs, one for * outgoing traffic and one for incomming traffic so normally two * IPsec SA are installed for each peer. Set to 0 for no restrictions */ IP_SYSVAR("ipike.max_ipsec_sa_num", "0", IPIKE_MAX_IPSEC_SA_NUM), /* The UDP port on which to listen for ISAKMP packets. 500 is the default IKE port */ IP_SYSVAR("ipike.port", "500", IPIKE_PORT), /* The UDP port on which to listen for ISAKMP packets when using NAT-Traversal. The only supported number is 4500 (limitation IPNet).*/ IP_SYSVAR("ipike.port_nat", "4500", IPIKE_NAT_PORT), /* Number of seconds between NAT-Traversal keep-alive packets. Default 20 seconds. */ IP_SYSVAR("ipike.keepalive_nat", "20", IPIKE_NAT_KEEPALIVE), /* Base time to wait (in seconds) before resending a ISAKMP message, the time to wait is calulated on tWait = ipike.resend_delay * resend_count */ IP_SYSVAR("ipike.resend_delay", "2", IPIKE_RESEND_DELAY), /* The filename where the configuration is stored */ #if defined(IP_PORT_LAS) IP_SYSVAR("ipike.filename", IPCOM_DEFAULT_CONF_ROOT "/ike.cfg", IPIKE_CONFIG_FILE_PATH IPIKE_CONFIG_FILE_NAME), #else IP_SYSVAR("ipike.filename", IPCOM_FILE_ROOT "ike.cfg", IPIKE_CONFIG_FILE_PATH IPIKE_CONFIG_FILE_NAME), #endif /* The size (in bytes) of the created nonce (must be 8-256) */ IP_SYSVAR("ipike.nonce_size", "64", IPIKE_NONCE_SIZE), /* Set this to 0 if IPIKE should not create a default 'ipike.filename' if no such already exists */ IP_SYSVAR( "ipike.create_default_conf", "1", IPIKE_CREATE_DEFAULT_CONFIG_FILE), /* Internal configuration variable. Set to 1 to allow duplicate IKE SAs */ IP_SYSVAR("ipike.allow_duplicate_ike_sa", "0", "0"), /* Set flush to 1 if IPIKE should flush IPSec keys at startup or shutdown, only needed when not running Interpeak IPSec */ #if !defined(IPIPSEC2) && !defined(IPIPSEC) && !defined(IP_PORT_OSE5) IP_SYSVAR("ipike.pfkeyv2.flush_startup", "1", IPIKE_FLUSH_STARTUP), IP_SYSVAR("ipike.pfkeyv2.flush_shutdown", "0", IPIKE_FLUSH_SHUTDOWN), #endif /* Enable this sysvar */ IP_SYSVAR("ipike.pfkeyv2.flush_reconfigure", "0", IPIKE_FLUSH_RECONFIGURE), /* Number of seconds before the hard timeout the soft timeout (and the renewal negotiation) should be */ IP_SYSVAR("ipike.pfkeyv2.soft_to_hard_time", "300", IPIKE_SOFT_TO_HARD_TIME), /* Dynamic address pool (responder), used for test to simulate VPN gateway */ IP_SYSVAR("ipike.address_pool.network4", "10.1.111.1/24", IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4), IP_SYSVAR("ipike.address_pool.dns4", "10.1.1.1", IPIKE_DYNAMIC_ADDRESS_POOL_DNS4), IP_SYSVAR("ipike.address_pool.anyflow", "0", IPIKE_DYNAMIC_ADDRESS_ANYFLOW), IP_SYSVAR("ipike.address_pool.homeaddr", "0", IPIKE_DYNAMIC_ADDRESS_HOMEADDR), /* Dynamic address mode IKE v1 (initiator): * 0 : Will set IPSec src flow as "any" address * 1 : Will set IPSec src flow as retrieved address * 2 : Will set IPSec src flow as retrieved network */ IP_SYSVAR("ipike.dynamic_address.mode", "1", IPIKE_DYNAMIC_ADDRESS_MODE), /* Set to '1' to enable MOBIKE (RFC4555), default '0' */ IP_SYSVAR("ipike.mobike", "0", "0"), /* Set to '1' to enable routability check for MOBIKE, default '1' */ IP_SYSVAR("ipike.mobike.routability_check", "1", "1"), /* Set to '1' to initiate rekey for IPSec SAs for passive connections. */ IP_SYSVAR("ipike.rekey_passive", "1", "1"), /* Rekey fuzziness in seconds, adds a random time to rekey margin */ IP_SYSVAR("ipike.rekey_fuzziness", "20", IPIKE_REKEY_FUZZINESS), /* The liveness timer resolution in seconds */ IP_SYSVAR("ipike.liveness_timer_resolution", "10", IPIKE_LIVENESS_TIMER_RESOLUTION), /* Allow fetching of certificates via HTTP */ IP_SYSVAR("ipike.use_hash_and_url", "0", IPIKE_USE_HASH_AND_URL), /* Number of seconds before timing out an HTTP request */ IP_SYSVAR("ipike.http_request_timeout", "5", IPIKE_HTTP_REQUEST_TIMEOUT), /* HTTP response buffer size in bytes */ IP_SYSVAR("ipike.http_response_buf_size", "4096", IPIKE_HTTP_RESPONSE_BUF_SIZE), /* Set to '1' to enable strict lifetime checking when accepting proposals */ { "ipike.strict_lifetime_policy", "0"}, /* Remove IKE SA if the negotiation of the IPsec SA fails, default '0' */ { "ipike.policy.delete_phase1_on_phase2_failure", "0" }, /* End marker */ { IP_NULL, IP_NULL } }; /* **************************************************************************** * 8 STATIC FUNCTIONS **************************************************************************** */ /* **************************************************************************** * 9 GLOBAL FUNCTIONS **************************************************************************** */ /* **************************************************************************** * 10 PUBLIC FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipike_configure *=========================================================================== * Description: Configures IPIKE. * Parameters: * Returns: * */ IP_PUBLIC Ip_err ipike_configure(void) { /* Set IPNET system variables. */ (void)ipcom_sysvar_setv(ipike_conf_sysvar, 0); #if defined(IP_DEBUG) && !defined(IP_PORT_VXWORKS) (void)ipcom_setlogmask_on(IPCOM_LOG_DEBUG2, IPCOM_LOG_IPIKE); #endif return IPCOM_SUCCESS; } /* **************************************************************************** * END OF FILE **************************************************************************** */