408 lines
14 KiB
C
408 lines
14 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_config.h,v $ $Revision: 1.34.10.7 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/config/ipike_config.h,v $
|
|
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:25 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#ifndef IPIKE_CONFIG_H
|
|
#define IPIKE_CONFIG_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* Defines for IPIKE */
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
#include <ipcom_config.h>
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_VERSION2
|
|
*===========================================================================
|
|
* Set define to enable IKE version2 protocol.
|
|
*/
|
|
#define IPIKE_USE_VERSION2
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_EAP
|
|
*===========================================================================
|
|
* Set define to enable EAP authentication mechanism for IKE version2
|
|
* protocol.
|
|
*/
|
|
#if defined(IPIKE_USE_VERSION2) && defined(IPEAP)
|
|
#define IPIKE_USE_EAP
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_RADIUS
|
|
*===========================================================================
|
|
* Set define to enable Radius. This define is needed for responder (EAP
|
|
* Supplicant) when running EAP authentication mechanism for IKE version2.
|
|
*/
|
|
#if defined(IPIKE_USE_EAP) && defined(IPRADIUS)
|
|
#define IPIKE_USE_RADIUS
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_ROHC
|
|
*===========================================================================
|
|
* Set define to enable ROHC parameter negotiation using IKEV2.
|
|
*/
|
|
#if defined(IPIKE_USE_VERSION2) && defined(IPROHC)
|
|
#define IPIKE_USE_ROHC
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_AGGRESSIVE_MODE
|
|
*===========================================================================
|
|
* Set define to enable aggressive mode negotiation for IKE version1
|
|
* protocol.
|
|
*/
|
|
#define IPIKE_USE_AGGRESSIVE_MODE
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_REAUTH_MARGIN_SEC
|
|
*===========================================================================
|
|
* The number of seconds before the IKE SA expires that reauthentication
|
|
* should take place.
|
|
*/
|
|
#define IPIKE_REAUTH_MARGIN_SEC 20
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_REKEY_MARGIN_SEC
|
|
*===========================================================================
|
|
* The number of seconds before the IKE SA expires that rekey should take
|
|
* place. Let rekey have some advantage compared to reauthentication by
|
|
* doubling the margin.
|
|
*/
|
|
#define IPIKE_REKEY_MARGIN_SEC (IPIKE_REAUTH_MARGIN_SEC + IPIKE_REAUTH_MARGIN_SEC)
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_REKEY_RETRY_TIMEOUT_MS
|
|
*===========================================================================
|
|
* The number of milliseconds to wait before retrying a rekey when the
|
|
* IKE SA is busy (exchange in progress). This timeout is also used for the
|
|
* same purpose when performing a reauhtentication.
|
|
*/
|
|
#define IPIKE_REKEY_RETRY_TIMEOUT_MS 1000
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_CRYPTO_TEST
|
|
*===========================================================================
|
|
* Enable crypto self test on startup
|
|
*/
|
|
#if defined(IP_DEBUG) && defined(IPIKE_USE_VERSION2)
|
|
#define IPIKE_USE_CRYPTO_SELF_TEST
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS
|
|
*===========================================================================
|
|
* The number of milliseconds to wait before retrying a INFORMATION exchange when the
|
|
* IKE SA is busy (exchange in progress).
|
|
*/
|
|
#define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS 1000
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE
|
|
*===========================================================================
|
|
* when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue.
|
|
* The default size of queue is 10.
|
|
*/
|
|
#define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE 10
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS
|
|
*===========================================================================
|
|
* The number of milliseconds to wait before retrying a INFORMATION exchange when the
|
|
* IKE SA is busy (exchange in progress).
|
|
*/
|
|
#define IPIKE_INFORMATIONAL_RETRY_TIMEOUT_MS 1000
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE
|
|
*===========================================================================
|
|
* when the IKE SA is busy (exchange in progress), will queue informational exchange into a queue.
|
|
* The default size of queue is 10.
|
|
*/
|
|
#define IPIKE_INFORMATIONAL_RETRY_QUEUE_SIZE 10
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND
|
|
*===========================================================================
|
|
* The ISAKMPD (on OpenBSD) will not allow that the key length is transmitted
|
|
* in the payloads during phase 1 or phase2. It will also consider the key
|
|
* length to be 256 bits during phase1 and 128 bits during phase 2.
|
|
*
|
|
* NOTE: This define will result in a bug, since there is no default for AES,
|
|
* at least not during phase 1.
|
|
*/
|
|
/*#define IPIKE_ISAKMPD_AES_KEY_LENGTH_BUG_WORKAROUND*/
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_AES_MAC
|
|
*===========================================================================
|
|
*
|
|
*/
|
|
#if !defined(OPENSSL_NO_AES) && defined(IPCRYPTO)
|
|
#define IPIKE_USE_AES_MAC
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPCOM_SYSLOG_PRIORITY
|
|
*===========================================================================
|
|
* Default syslog priority.
|
|
*/
|
|
#if defined(_WRS_CONFIG_IPIKE_SYSLOG_PRIORITY)
|
|
#define IPIKE_SYSLOG_PRIORITY _WRS_CONFIG_IPIKE_SYSLOG_PRIORITY
|
|
#else
|
|
#define IPIKE_SYSLOG_PRIORITY IPCOM_SYSLOG_PRIO_DEFAULT
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_PKTINFO
|
|
*===========================================================================
|
|
* Use PKTINFO processing to be able to listen on :: or 0.0.0.0.
|
|
* Can be only used if IPNET is defined
|
|
*/
|
|
#if defined(IPNET)
|
|
#define IPIKE_USE_PKTINFO
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_MIGRATE
|
|
*===========================================================================
|
|
* Define to enable pfkey migrate support for MIP daemons.
|
|
* Is dependent on pfkey defines in IPIPSEC and complaint behavior
|
|
* from MIP daemons.
|
|
* Currently IKE and IPSEC does not handle the MIGRATE messages
|
|
*/
|
|
/* #define IPIKE_USE_MIGRATE */
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_PERF_EVAL
|
|
*===========================================================================
|
|
* Performance evaluation code for IKEv1 and v2
|
|
*
|
|
*/
|
|
#define IPIKE_USE_PERF_EVAL
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_OCSP
|
|
*===========================================================================
|
|
* Use OCSP req/responses to verify certificate validity status
|
|
*
|
|
*/
|
|
#if !defined(OPENSSL_NO_OCSP) && defined(IPCRYPTO)
|
|
#define IPIKE_USE_OCSP
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_DPD_WINDOW_SIZE
|
|
*===========================================================================
|
|
* For IKEv1 only. This setting specifies the size of the DPD window which
|
|
* contains acceptable sequence numbers.
|
|
*
|
|
*/
|
|
#define IPIKE_DPD_WINDOW_SIZE 10
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_IKEV2_MAX_EXCH_IN_NEG
|
|
*===========================================================================
|
|
* For IKEv2 only. This setting specifies the maximum number of exchanges
|
|
* that is allowed to complete an IKEv2 negotiation. An IKEv2 negotiation is
|
|
* normally completed within 2 exchanges (one INIT and one AUTH) but if EAP
|
|
* is used as authentication method more exchanges are required. One exchange
|
|
* consists of one request-response message pair.
|
|
*
|
|
*/
|
|
#define IPIKE_IKEV2_MAX_EXCH_IN_NEG 15
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD
|
|
*===========================================================================
|
|
* If two or more IKE SAs from the same remote peer are established within
|
|
* this period of seconds they will be treated as a simultaneous (collision)
|
|
* exchange and the IKE SA containing the smallest nonce will be removed.
|
|
*
|
|
*/
|
|
#define IPIKE_IKE_SA_SIMULTANEOUS_ESTABLISHMENT_PERIOD 1
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_DISPATCHER_RECEIVE_RETRIES
|
|
*===========================================================================
|
|
* Number of times the IKE dispatcher will tolerate receive errors before
|
|
* it reconfigures itself (re-open listening UDP sockets)
|
|
*
|
|
*/
|
|
#define IPIKE_DISPATCHER_RECEIVE_RETRIES 3
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_USE_EVENT_LOG
|
|
*===========================================================================
|
|
* IKE Event logging. Each type of log event can be explicitly be removed
|
|
* at compile time by either removing the corresponding define below or
|
|
* by adding a #undef directive. Some of these events are triggered in the
|
|
* IPsec module and some in the IPIKE module. Events triggered from IPsec
|
|
* are sent to the IKE daemon via pfkeyv2 and then relayed to registered
|
|
* event receivers
|
|
*
|
|
*/
|
|
|
|
#ifdef _WRS_CONFIG_COMPONENT_IPIKE_USE_EVENT_LOG
|
|
/* Global switch, enables event logging */
|
|
#define IPIKE_USE_EVENT_LOG
|
|
#endif
|
|
|
|
|
|
#ifdef IPIKE_USE_EVENT_LOG
|
|
/*
|
|
* Log events, enable/disable specific log events here at compile time. By
|
|
* default all is turned on.
|
|
*/
|
|
|
|
/* Phase 2 hard lifesize expired */
|
|
#define IPIKE_USE_EVENT_HARD_LIFE_SIZE_EXPIRED
|
|
|
|
/* Phase 2 hard lifetime expired */
|
|
#define IPIKE_USE_EVENT_HARD_LIFE_TIME_EXPIRED
|
|
|
|
/* An IKE packet was discarded */
|
|
#define IPIKE_USE_EVENT_IKE_PACKET_DISCARD
|
|
|
|
/* Phase 1 (IKE SA) negotiation failed */
|
|
#define IPIKE_USE_EVENT_IKE_PHASE_I_FAIL
|
|
|
|
/* Phase 1 (IKE SA) negotiation completed successfully */
|
|
#define IPIKE_USE_EVENT_IKE_PHASE_I_SUCCESS
|
|
|
|
/* Phase 2 (IPsec SA) negotiation failed */
|
|
#define IPIKE_USE_EVENT_IKE_PHASE_II_FAIL
|
|
|
|
/* Phase 2 (IPsec SA) negotiation completed */
|
|
#define IPIKE_USE_EVENT_IKE_PHASE_II_SUCCESS
|
|
|
|
/* IPsec packet was discarded */
|
|
#define IPIKE_USE_EVENT_IPSEC_PACKET_DISCARD
|
|
|
|
/* IPsec SA sequence number overflowed or rolled over */
|
|
#define IPIKE_USE_EVENT_SEQUENCE_NUM_OVERFLOW
|
|
|
|
/* Phase 2 (IPsec SA) soft lifetime in bytes expired */
|
|
#define IPIKE_USE_EVENT_SOFT_LIFE_SIZE_EXPIRED
|
|
|
|
/* Phase 2 (IPsec SA) soft lifetime in time expired */
|
|
#define IPIKE_USE_EVENT_SOFT_LIFE_TIME_EXPIRED
|
|
|
|
/* An SPD packet was discarded */
|
|
#define IPIKE_USE_EVENT_SPD_PACKET_DISCARD
|
|
|
|
#endif /* IPIKE_USE_EVENT_LOG */
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_CONFIG_ROHC_INTEG_NUM_MAX
|
|
*===========================================================================
|
|
* The maximum number of integrity algorithms that can be configured and
|
|
* proposed when ROHC is enabled
|
|
*/
|
|
#define IPIKE_CONFIG_ROHC_INTEG_NUM_MAX 7
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_CONFIG_ROHC_INTEG_NUM_MAX
|
|
*===========================================================================
|
|
* The maximum number of ROHC profiles that can be configured.
|
|
*/
|
|
#define IPIKE_CONFIG_ROHC_PROFILE_NUM_MAX 8
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPIKE_ROHC_IFNAME_SIZE
|
|
*===========================================================================
|
|
* ROHC Interface name sizes
|
|
*/
|
|
#define IPIKE_ROHC_IFNAME_SIZE 16
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|