251 lines
9.7 KiB
C
251 lines
9.7 KiB
C
/*
|
|
******************************************************************************
|
|
* INTERPEAK CONFIGURATION SOURCE FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_config.c,v $ $Revision: 1.27.2.6 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/config/ipike_config.c,v $
|
|
* $Author: svc-cmnet $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include "ipike_config.h"
|
|
|
|
#define IPCOM_USE_CLIB_PROTO
|
|
#include <ipcom_sysvar.h>
|
|
#include <ipcom_err.h>
|
|
#include <ipcom_sock.h>
|
|
#include <ipcom_file.h>
|
|
#include <ipcom_clib.h>
|
|
#include <ipcom_syslog.h>
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 EXTERN PROTOTYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_configure
|
|
*===========================================================================
|
|
*/
|
|
IP_PUBLIC Ip_err
|
|
ipike_configure(void);
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 LOCAL PROTOTYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 7 DATA
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* SYSTEM VARIABLES
|
|
*===========================================================================
|
|
*/
|
|
IP_CONST Ipcom_sysvar ipike_conf_sysvar[] = {
|
|
/* ISAKMP socket buffer size (in bytes), this is the largest ISAKMP message
|
|
the IKE daemon can send and receive */
|
|
IP_SYSVAR("ipike.isakmp_sock_buf_size", "10000", IPIKE_SOCK_BUF_SIZE),
|
|
|
|
/* The maximum number of active exchanges, ISAKMP packets for new exchanges
|
|
will be dropped when the maximum is reached. Set to 0 to allow infinite
|
|
number of exchanges. */
|
|
IP_SYSVAR("ipike.isakmp_max_exchanges", "32", IPIKE_MAX_EXCHANGES),
|
|
|
|
/* The maximum size of an ISAKMP packet. Note that all IKEv2
|
|
implementations MUST be able to send, receive, and process
|
|
IKE messages that are up to 1280 octets long, and they SHOULD be able
|
|
to send, receive, and process messages that are up to 3000 octets
|
|
long. Set to 0 for unlimited (max UDP packet size) */
|
|
IP_SYSVAR("ipike.max_message_size", "0", IPIKE_MAX_MESSAGE_SIZE),
|
|
|
|
/* The maximum number of IKE SAs that are allowed to be established
|
|
* at the same time. New negotiations will be rejected when this limit
|
|
* is reached. Set to 0 for no restrictions */
|
|
IP_SYSVAR("ipike.max_ike_sa_num", "0", IPIKE_MAX_IKE_SA_NUM),
|
|
|
|
/* The maximum number of IPsec SAs that are allowed to be established
|
|
* at the same time. New requests will be rejected when this limit
|
|
* is reached. Note that IPsec SAs are intalled in pairs, one for
|
|
* outgoing traffic and one for incomming traffic so normally two
|
|
* IPsec SA are installed for each peer. Set to 0 for no restrictions */
|
|
IP_SYSVAR("ipike.max_ipsec_sa_num", "0", IPIKE_MAX_IPSEC_SA_NUM),
|
|
|
|
/* The UDP port on which to listen for ISAKMP packets.
|
|
500 is the default IKE port */
|
|
IP_SYSVAR("ipike.port", "500", IPIKE_PORT),
|
|
|
|
/* The UDP port on which to listen for ISAKMP packets when using NAT-Traversal.
|
|
The only supported number is 4500 (limitation IPNet).*/
|
|
IP_SYSVAR("ipike.port_nat", "4500", IPIKE_NAT_PORT),
|
|
|
|
/* Number of seconds between NAT-Traversal keep-alive packets. Default
|
|
20 seconds. */
|
|
IP_SYSVAR("ipike.keepalive_nat", "20", IPIKE_NAT_KEEPALIVE),
|
|
|
|
/* Base time to wait (in seconds) before resending a ISAKMP message,
|
|
the time to wait is calulated on tWait = ipike.resend_delay * resend_count */
|
|
IP_SYSVAR("ipike.resend_delay", "2", IPIKE_RESEND_DELAY),
|
|
|
|
/* The filename where the configuration is stored */
|
|
#if defined(IP_PORT_LAS)
|
|
IP_SYSVAR("ipike.filename", IPCOM_DEFAULT_CONF_ROOT "/ike.cfg", IPIKE_CONFIG_FILE_PATH IPIKE_CONFIG_FILE_NAME),
|
|
#else
|
|
IP_SYSVAR("ipike.filename", IPCOM_FILE_ROOT "ike.cfg", IPIKE_CONFIG_FILE_PATH IPIKE_CONFIG_FILE_NAME),
|
|
#endif
|
|
|
|
/* The size (in bytes) of the created nonce (must be 8-256) */
|
|
IP_SYSVAR("ipike.nonce_size", "64", IPIKE_NONCE_SIZE),
|
|
|
|
/* Set this to 0 if IPIKE should not create a default 'ipike.filename' if
|
|
no such already exists */
|
|
IP_SYSVAR( "ipike.create_default_conf", "1", IPIKE_CREATE_DEFAULT_CONFIG_FILE),
|
|
|
|
/* Internal configuration variable. Set to 1 to allow duplicate IKE SAs */
|
|
IP_SYSVAR("ipike.allow_duplicate_ike_sa", "0", "0"),
|
|
|
|
/* Set flush to 1 if IPIKE should flush IPSec keys at startup or shutdown,
|
|
only needed when not running Interpeak IPSec */
|
|
|
|
#if !defined(IPIPSEC2) && !defined(IPIPSEC) && !defined(IP_PORT_OSE5)
|
|
IP_SYSVAR("ipike.pfkeyv2.flush_startup", "1", IPIKE_FLUSH_STARTUP),
|
|
IP_SYSVAR("ipike.pfkeyv2.flush_shutdown", "0", IPIKE_FLUSH_SHUTDOWN),
|
|
#endif
|
|
/* Enable this sysvar */
|
|
IP_SYSVAR("ipike.pfkeyv2.flush_reconfigure", "0", IPIKE_FLUSH_RECONFIGURE),
|
|
|
|
|
|
/* Number of seconds before the hard timeout the soft timeout (and the renewal
|
|
negotiation) should be */
|
|
IP_SYSVAR("ipike.pfkeyv2.soft_to_hard_time", "300", IPIKE_SOFT_TO_HARD_TIME),
|
|
|
|
/* Dynamic address pool (responder), used for test to simulate VPN gateway */
|
|
IP_SYSVAR("ipike.address_pool.network4", "10.1.111.1/24", IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4),
|
|
IP_SYSVAR("ipike.address_pool.dns4", "10.1.1.1", IPIKE_DYNAMIC_ADDRESS_POOL_DNS4),
|
|
IP_SYSVAR("ipike.address_pool.anyflow", "0", IPIKE_DYNAMIC_ADDRESS_ANYFLOW),
|
|
IP_SYSVAR("ipike.address_pool.homeaddr", "0", IPIKE_DYNAMIC_ADDRESS_HOMEADDR),
|
|
|
|
/* Dynamic address mode IKE v1 (initiator):
|
|
* 0 : Will set IPSec src flow as "any" address
|
|
* 1 : Will set IPSec src flow as retrieved address
|
|
* 2 : Will set IPSec src flow as retrieved network */
|
|
IP_SYSVAR("ipike.dynamic_address.mode", "1", IPIKE_DYNAMIC_ADDRESS_MODE),
|
|
|
|
/* Set to '1' to enable MOBIKE (RFC4555), default '0' */
|
|
IP_SYSVAR("ipike.mobike", "0", "0"),
|
|
|
|
/* Set to '1' to enable routability check for MOBIKE, default '1' */
|
|
IP_SYSVAR("ipike.mobike.routability_check", "1", "1"),
|
|
|
|
/* Set to '1' to initiate rekey for IPSec SAs for passive connections. */
|
|
IP_SYSVAR("ipike.rekey_passive", "1", "1"),
|
|
|
|
/* Rekey fuzziness in seconds, adds a random time to rekey margin */
|
|
IP_SYSVAR("ipike.rekey_fuzziness", "20", IPIKE_REKEY_FUZZINESS),
|
|
|
|
/* The liveness timer resolution in seconds */
|
|
IP_SYSVAR("ipike.liveness_timer_resolution", "10", IPIKE_LIVENESS_TIMER_RESOLUTION),
|
|
|
|
/* Allow fetching of certificates via HTTP */
|
|
IP_SYSVAR("ipike.use_hash_and_url", "0", IPIKE_USE_HASH_AND_URL),
|
|
|
|
/* Number of seconds before timing out an HTTP request */
|
|
IP_SYSVAR("ipike.http_request_timeout", "5", IPIKE_HTTP_REQUEST_TIMEOUT),
|
|
|
|
/* HTTP response buffer size in bytes */
|
|
IP_SYSVAR("ipike.http_response_buf_size", "4096", IPIKE_HTTP_RESPONSE_BUF_SIZE),
|
|
|
|
/* Set to '1' to enable strict lifetime checking when accepting proposals */
|
|
{ "ipike.strict_lifetime_policy", "0"},
|
|
|
|
/* Remove IKE SA if the negotiation of the IPsec SA fails, default '0' */
|
|
{ "ipike.policy.delete_phase1_on_phase2_failure", "0" },
|
|
|
|
/* End marker */
|
|
{ IP_NULL, IP_NULL }
|
|
};
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 8 STATIC FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 9 GLOBAL FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 10 PUBLIC FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_configure
|
|
*===========================================================================
|
|
* Description: Configures IPIKE.
|
|
* Parameters:
|
|
* Returns:
|
|
*
|
|
*/
|
|
IP_PUBLIC Ip_err
|
|
ipike_configure(void)
|
|
{
|
|
/* Set IPNET system variables. */
|
|
(void)ipcom_sysvar_setv(ipike_conf_sysvar, 0);
|
|
|
|
#if defined(IP_DEBUG) && !defined(IP_PORT_VXWORKS)
|
|
(void)ipcom_setlogmask_on(IPCOM_LOG_DEBUG2, IPCOM_LOG_IPIKE);
|
|
#endif
|
|
|
|
return IPCOM_SUCCESS;
|
|
}
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|
|
|