1134 lines
41 KiB
C
1134 lines
41 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_configuration.h,v $ $Revision: 1.29.10.11 $
|
|
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_configuration.h,v $
|
|
* $Author: yli12 $ $Date: 2018-02-07 06:24:37 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#ifndef IPIKE_CONFIGURATION_H
|
|
#define IPIKE_CONFIGURATION_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
#include "ipike_config.h"
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include "ipike.h"
|
|
#include "ipike_configuration_parse.h"
|
|
#include "ipike_configuration_api.h"
|
|
#include <openssl/x509.h>
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#define IPIKE_CONFIG_DEF_RETRANSMITS 3
|
|
#define IPIKE_CONFIG_DEF_SPI_MIN 1
|
|
#define IPIKE_CONFIG_DEF_SPI_MAX 0xffffffff
|
|
#define IPIKE_CONFIG_DEF_IKE_SA_LIFETIME 43200 /* 12 hours */
|
|
#define IPIKE_CONFIG_DEF_IPSEC_SA_LIFETIME 28800 /* 8 hours */
|
|
|
|
/* Default ROHC parameters */
|
|
#define IPIKE_CONFIG_DEF_ROHC_MAX_CID 16
|
|
#define IPIKE_CONFIG_DEF_ROHC_MRRU 0
|
|
#define IPIKE_CONFIG_DEF_ROHC_ICV_LEN 0
|
|
|
|
/* current support version in configration */
|
|
#define IPIKE_CONFIG_SUPPORT_V1 1
|
|
#define IPIKE_CONFIG_SUPPORT_V2 2
|
|
#define IPIKE_CONFIG_SUPPORT_V1_AND_V2 3
|
|
|
|
#define IPIKE_CONFIG_UNSPEC_BOOL ((Ip_bool)-1)
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
typedef enum Ipike_config_netobj_type_enum
|
|
{
|
|
IPIKE_CONFIG_NETOBJ_INVALID = 0,
|
|
IPIKE_CONFIG_NETOBJ_HOST = 1,
|
|
IPIKE_CONFIG_NETOBJ_NET = 2,
|
|
IPIKE_CONFIG_NETOBJ_RANGE = 3
|
|
} Ipike_config_netobj_type;
|
|
|
|
|
|
typedef struct Ipike_config_netobj_struct
|
|
{
|
|
Ipike_config_netobj_type type;
|
|
union Ip_sockaddr_union addr;
|
|
union Ip_sockaddr_union high_or_mask;
|
|
}
|
|
Ipike_config_netobj;
|
|
|
|
typedef struct Ipike_config_radius_struct
|
|
{
|
|
union Ip_sockaddr_union server_address;
|
|
union Ip_sockaddr_union local_address;
|
|
const char* shared_secret;
|
|
}
|
|
Ipike_config_radius;
|
|
|
|
typedef struct Ipike_config_proposal_struct
|
|
{
|
|
Ip_u8 id;
|
|
const char* dh_group;
|
|
const char* hash_alg;
|
|
const char* encryption_alg;
|
|
const char* integrity_alg;
|
|
const char* use_esn;
|
|
struct
|
|
{
|
|
/* Parameters only for IKEv1 */
|
|
Ip_u32** lifetime_seconds; /* IP_NULL terminated array of lifetimes */
|
|
Ip_u64** lifetime_kilobytes; /* IP_NULL terminated array of lifetimes */
|
|
} v1;
|
|
Ip_u32 number;
|
|
}
|
|
Ipike_config_proposal;
|
|
|
|
typedef struct Ipike_config_auth_struct
|
|
{
|
|
const char* method;
|
|
const char* psk_id;
|
|
const char* shared_key;
|
|
const char* certificate;
|
|
const char* send_certificate;
|
|
const char* request_certificate;
|
|
const char* certificate_uri;
|
|
const char* ocsp_response;
|
|
const char* remote_certificate;
|
|
const char* key_id;
|
|
const char* private_key;
|
|
const char* private_key_password;
|
|
const char* trusted_ca_store;
|
|
const char* crl_store;
|
|
const char* intermediate_ca_store;
|
|
const char* identity;
|
|
}
|
|
Ipike_config_auth;
|
|
|
|
typedef struct Ipike_config_flow_struct
|
|
{
|
|
Ipike_config_netobj** src; /* NULL terminated array of netobjects */
|
|
Ipike_config_netobj** dst; /* NULL terminated array of netobjects */
|
|
Ip_u8 protocol; /* Flow protocol (UDP, TCP, etc.) */
|
|
Ip_u8 type; /* Flow type */
|
|
}
|
|
Ipike_config_flow;
|
|
|
|
#ifdef IPIKE_USE_ROHC
|
|
typedef struct Ipike_config_rohc_struct
|
|
{
|
|
Ip_u16 max_cid;
|
|
Ip_u16 icv_len;
|
|
Ip_u16 mrru;
|
|
Ip_u16 num_integ_algs;
|
|
Ip_u16 num_profiles;
|
|
Ip_u16 integ_algs[IPIKE_CONFIG_ROHC_INTEG_NUM_MAX];
|
|
Ip_u16 profiles[IPIKE_CONFIG_ROHC_PROFILE_NUM_MAX];
|
|
|
|
} Ipike_config_rohc;
|
|
#endif /* IPIKE_USE_ROHC */
|
|
|
|
typedef struct Ipike_config_ipsec_sa_struct
|
|
{
|
|
const char* ike_id;
|
|
const char* ipsec_id;
|
|
const char* encap_mode;
|
|
const char* use_tfc;
|
|
const char* flowtype;
|
|
const char* use_ecn;
|
|
const char* granularity;
|
|
Ip_u32 replay_window;
|
|
Ip_u32** lifetime_seconds; /* IP_NULL terminated array of lifetimes */
|
|
Ip_u64** lifetime_kilobytes; /* IP_NULL terminated array of lifetimes */
|
|
Ipike_config_flow flow;
|
|
Ipike_config_proposal** proposals; /* IP_NULL terminated array of proposals */
|
|
const char* dynamic_address; /* Request address from responder */
|
|
struct Ipike_config_ike_sa_struct* ike_sa; /* The corresponding IKE SA config */
|
|
|
|
#ifdef IPIKE_USE_ROHC
|
|
Ipike_config_rohc * rohc;
|
|
#endif /* IPIKE_USE_ROHC */
|
|
|
|
/* The following parameters is used internally */
|
|
Ip_u32 rekey_spi; /* Set to spi value if rekey */
|
|
Ip_bool updated; /* Configuration updated */
|
|
}
|
|
Ipike_config_ipsec_sa;
|
|
|
|
typedef struct Ipike_config_ike_sa_struct
|
|
{
|
|
const char* ike_id;
|
|
const char* version;
|
|
const char* mode;
|
|
union Ip_sockaddr_union local_address;
|
|
Ipike_config_netobj remote_address;
|
|
Ip_bool passive;
|
|
Ip_bool initial_contact;
|
|
Ip_bool reauth;
|
|
Ip_s32 liveness;
|
|
const char* local_id;
|
|
const char* remote_id;
|
|
Ip_u32** lifetime_seconds; /* IP_NULL terminated array of lifetimes */
|
|
Ip_u64** lifetime_kilobytes; /* IP_NULL terminated array of lifetimes */
|
|
Ipike_config_auth authentication;
|
|
Ipike_config_proposal** proposals; /* IP_NULL terminated array of proposals */
|
|
Ipike_config_ipsec_sa** ipsec_sas; /* The corresponding IPSec SA config(s) */
|
|
Ipike_config_radius radius;
|
|
/* The following parameters is used internally */
|
|
Ip_bool updated; /* Configuration updated */
|
|
}
|
|
Ipike_config_ike_sa;
|
|
|
|
typedef struct Ipike_config_general_struct
|
|
{
|
|
union Ip_sockaddr_union** listen;
|
|
Ip_u32 retransmits;
|
|
Ip_u32 exchange_max_time;
|
|
Ip_u32 spi_min;
|
|
Ip_u32 spi_max;
|
|
Ipike_config_ike_sa* def_ike_sa;
|
|
Ipike_config_ipsec_sa* def_ipsec_sa;
|
|
}
|
|
Ipike_config_general;
|
|
|
|
typedef struct Ipike_config_ike_struct
|
|
{
|
|
Ipike_config_general general;
|
|
Ipike_config_ike_sa** ike_sa; /* IP_NULL terminated array of ike_sa */
|
|
Ipike_config_ipsec_sa** ipsec_sa; /* IP_NULL terminated array of ipsec_sa */
|
|
}
|
|
Ipike_config_ike;
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_initialize
|
|
*===========================================================================
|
|
* Description: Parses a buffer with the configuration.
|
|
* Parameters: data - a zero terminated string containing the configuration.
|
|
* Returns: IPIKE_SUCCESS
|
|
* IPIKE_CONF_PARSE_ERROR
|
|
*
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_initialize(const char* data);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_finalize
|
|
*===========================================================================
|
|
* Description: Frees all resources allocated by the configuration module.
|
|
* Parameters:
|
|
* Returns:
|
|
*
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_finalize(void);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_set_general
|
|
*===========================================================================
|
|
* Description: Set general configuartion part.
|
|
* Parameters: conf - the internal general configuration.
|
|
* general - the api general configuration.
|
|
* Returns: Standard IKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_set_general(
|
|
Ipike_config_general* conf,
|
|
Ipike_config_api_general* general);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_general
|
|
*===========================================================================
|
|
* Description: Get general configuartion part.
|
|
* Parameters: conf - the internal general configuration.
|
|
* general - the api general configuration.
|
|
* Returns: Standard IKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_get_general(
|
|
Ipike_config_general* conf,
|
|
Ipike_config_api_general* general);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_set_ike_sa
|
|
*===========================================================================
|
|
* Description: Add a new IKE SA config to array of configurations. Will
|
|
* replace old with same id (if available).
|
|
* Parameters: conf - the array of configurations.
|
|
* ike_id - id of new IKE SA.
|
|
* ike - the new ike configuration to add.
|
|
* Returns: Standard IKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_set_ike_sa(
|
|
Ipike_config_ike_sa*** conf,
|
|
const char* ike_id,
|
|
Ipike_config_api_ike_sa* ike);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_next_ike_sa
|
|
*===========================================================================
|
|
* Description: Retrive next ike sa part from configuration.
|
|
* Parameters: conf - A configuration context.
|
|
* ike_id - Will receive the id of the ike configuration part.
|
|
* ike - Will receive ike configuration part.
|
|
* pos - Enumerator variable, set to IPIKE_CONFIG_INVALID_VALUE
|
|
* for first call and will be updated internally.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_get_next_ike_sa(
|
|
Ipike_config_ike_sa* def_conf,
|
|
Ipike_config_ike_sa** conf,
|
|
char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
|
|
Ipike_config_api_ike_sa* ike,
|
|
int* pos);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_set_ike_sa_proposal
|
|
*===========================================================================
|
|
* Description: Add a new IKE SA proposal to an existing IKE SA.
|
|
* Parameters: conf - the array of configurations.
|
|
* ike_id - id of IKE SA.
|
|
* proposal - the new proposal configuration to add.
|
|
* Returns: Standard IKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_set_ike_sa_proposal(
|
|
Ipike_config_ike_sa*** conf,
|
|
const char* ike_id,
|
|
int* proposal_id,
|
|
Ipike_config_api_proposal* proposal);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_next_ike_sa_proposal
|
|
*===========================================================================
|
|
* Description: Will get next available proposal from ike sa configuration.
|
|
* Parameters: conf - A configuration context.
|
|
* ike_id - The id of the ike sa configuration.
|
|
* proposal_id - Will receive the proposal id.
|
|
* proposal - Will receive next proposal.
|
|
* pos - Enumerator variable, set to IPIKE_CONFIG_INVALID_VALUE
|
|
* for first call and will be updated internally.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_get_next_ike_sa_proposal(
|
|
Ipike_config_ike_sa* def_conf,
|
|
Ipike_config_ike_sa** conf,
|
|
const char ike_id[IPIKE_CONFIG_MAX_ID_LEN],
|
|
int* proposal_id,
|
|
Ipike_config_api_proposal* proposal,
|
|
int* pos);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_next_ipsec_sa_proposal
|
|
*===========================================================================
|
|
* Description: Will get next available proposal from ipsec sa configuration.
|
|
* Parameters: conf - A configuration context.
|
|
* ipsec_id - The id of the ipsec sa configuration.
|
|
* proposal_id - Will receive the proposal id.
|
|
* proposal - Will receive next proposal.
|
|
* pos - Enumerator variable, set to IPIKE_CONFIG_INVALID_VALUE
|
|
* for first call and will be updated internally.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_get_next_ipsec_sa_proposal(
|
|
Ipike_config_ipsec_sa* def_conf,
|
|
Ipike_config_ipsec_sa** conf,
|
|
const char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
|
|
int* proposal_id,
|
|
Ipike_config_api_proposal* proposal,
|
|
int* pos);
|
|
|
|
|
|
#ifdef IPIKE_USE_ROHC
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_set_ipsec_sa_rohc
|
|
*===========================================================================
|
|
* Description: Enables Robust Header Compression (ROHC) on the IPsec SA.
|
|
* Replace old with same id (if available).
|
|
* Parameters: conf - the array of configurations.
|
|
* ipsec_id - The id of the ipsec sa configuration.
|
|
* rohc - The ROHC configuration parameters.
|
|
* Returns: Standard IKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_set_ipsec_sa_rohc(
|
|
Ipike_config_ipsec_sa*** conf,
|
|
const char* ipsec_id,
|
|
Ipike_config_api_rohc* rohc);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_ipsec_sa_rohc
|
|
*===========================================================================
|
|
* Description: Get the Robust Header Compression (ROHC) on an IPsec SA.
|
|
*
|
|
* Parameters: conf - the array of configurations.
|
|
* ipsec_id - The id of the ipsec sa configuration.
|
|
* rohc - The ROHC configuration parameters.
|
|
* Returns: Standard IKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error ipike_config_get_ipsec_sa_rohc(
|
|
Ipike_config_ipsec_sa* def_conf,
|
|
Ipike_config_ipsec_sa*** conf,
|
|
const char* ipsec_id,
|
|
Ipike_config_api_rohc* rohc);
|
|
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_set_ipsec_sa
|
|
*===========================================================================
|
|
* Description: Add a new IPSec SA config to array of configurations. Will
|
|
* replace old with same id (if available).
|
|
* Parameters: conf - the array of configurations.
|
|
* ipsec_id - id of new IKE SA.
|
|
* ipsec - the new ipsec configuration to add.
|
|
* Returns: Standard IKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_set_ipsec_sa(
|
|
Ipike_config_ipsec_sa*** conf,
|
|
const char* ipsec_id,
|
|
Ipike_config_api_ipsec_sa* ipsec);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_next_ipsec_sa
|
|
*===========================================================================
|
|
* Description: Retrive next ipsec sa part from configuration.
|
|
* Parameters: conf - A configuration context.
|
|
* ipsec_id - Will receive the id of the ipsec configuration part.
|
|
* ipsec - Will receive ipsec configuration part.
|
|
* pos - Enumerator variable, set to IPIKE_CONFIG_INVALID_VALUE
|
|
* for first call and will be updated internally.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_get_next_ipsec_sa(
|
|
Ipike_config_ipsec_sa* def_conf,
|
|
Ipike_config_ipsec_sa** conf,
|
|
char ipsec_id[IPIKE_CONFIG_MAX_ID_LEN],
|
|
Ipike_config_api_ipsec_sa* ipsec,
|
|
int* pos);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_set_ipsec_sa_proposal
|
|
*===========================================================================
|
|
* Description: Add a new IPSec SA proposal to an existing IPSec SA.
|
|
* Parameters: conf - the array of configurations.
|
|
* ipsec_id - id of IPSec SA.
|
|
* proposal - the new proposal configuration to add.
|
|
* Returns: Standard IKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_set_ipsec_sa_proposal(
|
|
Ipike_config_ipsec_sa*** conf,
|
|
const char* ipsec_id,
|
|
int* proposal_id,
|
|
Ipike_config_api_proposal* proposal);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_set
|
|
*===========================================================================
|
|
* Description: Load configuration from data buffer.
|
|
* Parameters: config - The ike configuration context.
|
|
* buf - Buffer with configuration data.
|
|
* buf_len - Length of buffer.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_set(Ipike_config_ike* config, const char* buf, Ip_size_t buf_len);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get
|
|
*===========================================================================
|
|
* Description: Convert configuration to data buffer.
|
|
* Parameters: config - The ike configuration context.
|
|
* data - Pointer to buffer that will receive configuration data.
|
|
* len - Pointer to length that wil receive configuration data
|
|
* length.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_get(Ipike_config_ike* config, char* buf, Ip_size_t* buf_len);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_free
|
|
*===========================================================================
|
|
* Description: Frees all resources allocated by the configuration context.
|
|
* Parameters: The ike configuration context.
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_free(Ipike_config_ike* config);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_validate
|
|
*===========================================================================
|
|
* Description: Validate the specified configuration.
|
|
* Parameters: config - The ike configuration context.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_validate(Ipike_config_ike* config);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_commit
|
|
*===========================================================================
|
|
* Description: Commit the specified configuration.
|
|
* Parameters: The ike configuration context.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_commit(Ipike_config_ike* config);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_ike_sa_from_id
|
|
*===========================================================================
|
|
* Description: Returns the configuration for the IKE SA that have the
|
|
* specified id.
|
|
* Parameters: ike_sas - array of ike sas.
|
|
* ike_id - the IKE id.
|
|
* Returns: The IKE SA configuration structure (or NULL if not found).
|
|
*/
|
|
IP_GLOBAL Ipike_config_ike_sa*
|
|
ipike_config_get_ike_sa_from_id(
|
|
Ipike_config_ike_sa** ike_sas,
|
|
const char* ike_id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_ipsec_sa_from_id
|
|
*===========================================================================
|
|
* Description: Returns the configuration for the IPSec SA that have the
|
|
* specified id.
|
|
* Parameters: ipsec_sas - array of ipsec sas.
|
|
* ipsec_id - the IPSec id.
|
|
* Returns: The IPSec SA configuration structure (or NULL if not found).
|
|
*/
|
|
IP_GLOBAL Ipike_config_ipsec_sa*
|
|
ipike_config_get_ipsec_sa_from_id(
|
|
Ipike_config_ipsec_sa** ipsec_sas,
|
|
const char* ipsec_id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_propopsal_from_id
|
|
*===========================================================================
|
|
* Description: Returns the configuration for the IPSec SA that have the
|
|
* specified id.
|
|
* Parameters: prop - the array of proposals to receive proposal from.
|
|
* id - identifier of proposal to receive
|
|
* Returns: The IPSec SA configuration structure (or NULL if not found).
|
|
*/
|
|
IP_GLOBAL Ipike_config_proposal*
|
|
ipike_config_get_propopsal_from_id(Ipike_config_proposal** prop, Ip_u8 id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_remove_ike_sa
|
|
*===========================================================================
|
|
* Description: Remove specified ike sa from configuration.
|
|
* Parameters: conf - The configuration to remove from.
|
|
* ike_id - the IKE id.
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_remove_ike_sa(Ipike_config_ike* conf, const char* ike_id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_remove_ipsec_sa
|
|
*===========================================================================
|
|
* Description: Remove specified ipsec sa from configuration.
|
|
* Parameters: conf - The configuration to remove from.
|
|
* ipsec_id - the IPSec id.
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_remove_ipsec_sa(Ipike_config_ike* conf, const char* ipsec_id);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_remove_proposal
|
|
*===========================================================================
|
|
* Description: Remove specified proposal from array of proposals.
|
|
* Parameters: prop - The array of proposals
|
|
* id - the proposal id.
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_remove_proposal(Ipike_config_proposal*** prop, Ip_u8 id);
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_ike_version
|
|
*===========================================================================
|
|
* Description: Returns the configuration for the IKE SA that have the
|
|
* specified local/peer address.
|
|
* Parameters: local_addr - the local IKE address.
|
|
* peer_addr - the peer IKE address.
|
|
* preferred_version - Preferred IKE version (0 = any)
|
|
* Returns: The IKE SA configuration version (-1,1 or 2).
|
|
*/
|
|
|
|
IP_GLOBAL
|
|
ipike_config_get_ike_version(union Ip_sockaddr_union * local_addr,
|
|
union Ip_sockaddr_union * peer_addr,
|
|
int preferred_version);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_isakmp_accept_version
|
|
*===========================================================================
|
|
* Description: Returns IP_TRUE if the specified IKE SA configuration
|
|
* accepts the specified IKE version (1 or 2).
|
|
* Parameters: ike_conf - IKE SA configuration
|
|
* version - IKE version
|
|
* Returns: IP_TRUE if the IKE SA config support the IKE version else
|
|
* IP_FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_accept_ike_version(Ipike_config_ike_sa *ike_conf, int version);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_ike_sa_from_address
|
|
*===========================================================================
|
|
* Description: Returns the configuration for the IKE SA that have the
|
|
* specified local/peer address.
|
|
* Parameters: local_addr - the local IKE address.
|
|
* peer_addr - the peer IKE address.
|
|
* preferred_version - Preferred IKE version (0 = any)
|
|
* Returns: The IKE SA configuration structure (or NULL if not found).
|
|
*/
|
|
IP_GLOBAL Ipike_config_ike_sa*
|
|
ipike_config_get_ike_sa_from_address(
|
|
union Ip_sockaddr_union* local_addr,
|
|
union Ip_sockaddr_union* peer_addr,
|
|
int preferred_version);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_ike_sa_from_address
|
|
*===========================================================================
|
|
* Description: Returns the configuration for the IKE SA that have the
|
|
* specified local/peer address and remote id.
|
|
* Parameters: local_addr - the local IKE address.
|
|
* peer_addr - the peer IKE address.
|
|
* id_type - Type of identification
|
|
* id_data - Identification data
|
|
* X509 - Peer certificate containg the id
|
|
* preferred_version - Preferred IKE version
|
|
* Returns: The IKE SA configuration structure (or NULL if not found).
|
|
*/
|
|
IP_GLOBAL Ipike_config_ike_sa*
|
|
ipike_config_get_ike_sa_from_address_and_remote_id(
|
|
void *ie,
|
|
union Ip_sockaddr_union* local_addr,
|
|
union Ip_sockaddr_union* peer_addr,
|
|
Ip_u8 id_type,
|
|
Ipike_value* id_data,
|
|
X509* cert
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_ipsec_sa_from_flow
|
|
*===========================================================================
|
|
* Description: Returns the configuration for the IPSec SA that matches the
|
|
* flow.
|
|
* Parameters: flow - The IPsec flow to match.
|
|
* Returns: The IPSec SA configuration structure (or NULL if not found).
|
|
*/
|
|
IP_GLOBAL Ipike_config_ipsec_sa*
|
|
ipike_config_get_ipsec_sa_from_flow(
|
|
Ipike_config_flow* flow);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_get_private_key_password
|
|
*===========================================================================
|
|
* Description: Returns the private key password for the specified file name.
|
|
* Parameters: filename - the file name.
|
|
* Returns: The private key password (or NULL if not found).
|
|
*/
|
|
IP_GLOBAL const char*
|
|
ipike_config_get_private_key_password(const char* filename);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_should_append
|
|
*===========================================================================
|
|
* Description: Should the content in the configuration buffer be append to
|
|
* existing configuration or not.
|
|
* Parameters: buf - Pointer to configuration buffer.
|
|
* len - Length of configuration buffer.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_should_append(char* buf, Ip_size_t buf_len);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_flow_create
|
|
*===========================================================================
|
|
* Description: Creates and initializes a new flow
|
|
*
|
|
* Parameters:
|
|
*
|
|
* Returns: A new flow
|
|
*/
|
|
IP_GLOBAL Ipike_config_flow *
|
|
ipike_config_flow_create(void);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_flow_destroy
|
|
*===========================================================================
|
|
* Description: Destroys and frees a flow
|
|
*
|
|
* Parameters: flow - Flow to destroy
|
|
*
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_flow_destroy(
|
|
Ipike_config_flow * flow);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_flow_init
|
|
*===========================================================================
|
|
* Description: Initializes a flow. Should always be called if the flow
|
|
* wasn't created by ipike_config_flow_create.
|
|
*
|
|
*
|
|
* Parameters: flow - Flow to initialize
|
|
*
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_flow_init(Ipike_config_flow * flow);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_flow_copy
|
|
*===========================================================================
|
|
* Description: Copies the information in the source flow to the destination
|
|
* flow.
|
|
*
|
|
* Parameters: dst - Destination flow
|
|
* src - Source flow
|
|
*
|
|
* Returns:
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_flow_copy(
|
|
Ipike_config_flow * dst,
|
|
const Ipike_config_flow * src);
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_flow_duplicate
|
|
*===========================================================================
|
|
* Description: Creates a duplicate of the flow
|
|
*
|
|
* Parameters: flow - Flow to duplicate
|
|
*
|
|
* Returns: The new flow
|
|
*/
|
|
IP_GLOBAL Ipike_config_flow *
|
|
ipike_config_flow_duplicate(
|
|
const Ipike_config_flow * flow);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_flow_match
|
|
*===========================================================================
|
|
* Description: Returns true if the flow2 matches flow1.
|
|
*
|
|
* Parameters: flow1 - Flow to match
|
|
* flow2 - Flow to be matched with flow1
|
|
*
|
|
* Returns: IP_TRUE if the flow
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_flow_match(
|
|
Ipike_config_flow * flow1,
|
|
Ipike_config_flow * flow2);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_config_netobj_from_strings
|
|
*===========================================================================
|
|
* Description: Creates a net object from two strings.
|
|
* Example strings: "192.168.0.1", or
|
|
* "192.168.0.0/24"
|
|
*
|
|
* Parameters: netobj - Net object
|
|
* low - Address string
|
|
* high - Address string (Optional)
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_netobj_from_strings(
|
|
Ipike_config_netobj *netobj,
|
|
const char *low,
|
|
const char *high);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_from_string
|
|
*===========================================================================
|
|
* Description: Creates a net object from a single string.
|
|
* Example strings: "192.168.0.1", or
|
|
* "192.168.0.0/24" or
|
|
* "192.168.0.1-192.168.0.10".
|
|
* Parameters: netobj - Net object
|
|
* str - string
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_netobj_from_string(
|
|
Ipike_config_netobj *obj,
|
|
const char *str);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_match_addr
|
|
*===========================================================================
|
|
* Description: Returns IP_TRUE if the address is a subset of netobj.
|
|
* Parameters: netobj - Net object
|
|
* addr - IP Address
|
|
* Returns: IP_TRUE or IP_FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_netobj_match_addr(
|
|
Ipike_config_netobj *obj,
|
|
union Ip_sockaddr_union *addr);
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_match_network
|
|
*===========================================================================
|
|
* Description: Returns IP_TRUE if the network is a subset of netobj.
|
|
* Parameters: netobj - Net object.
|
|
* network - Network address.
|
|
* netmak - Network mask.
|
|
* Returns: IP_TRUE or IP_FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_netobj_match_network(
|
|
Ipike_config_netobj* netobj,
|
|
union Ip_sockaddr_union* network,
|
|
union Ip_sockaddr_union* netmask
|
|
);
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_match_range
|
|
*===========================================================================
|
|
* Description: Returns IP_TRUE if the range is a subset of netobj.
|
|
* Parameters: netobj - Net object.
|
|
* low - Lower address in range.
|
|
* high - Higer address in range.
|
|
* Returns:IP_TRUE or IP_FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_netobj_match_range(
|
|
Ipike_config_netobj* netobj,
|
|
union Ip_sockaddr_union* low,
|
|
union Ip_sockaddr_union* high
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_match_netobj
|
|
*===========================================================================
|
|
* Description: Returns IP_TRUE if n is a subset of netobj
|
|
* Parameters: netobj - Net object
|
|
* n - Net object
|
|
* Returns: IP_TRUE or IP_FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_netobj_match_netobj(
|
|
Ipike_config_netobj *netobj,
|
|
Ipike_config_netobj *n);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_is_host
|
|
*===========================================================================
|
|
* Description: Returns IP_TRUE if the net object contains a host address.
|
|
* Parameters: netobj - Net object
|
|
* Returns: IP_TRUE or IP_FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_netobj_is_host(
|
|
const Ipike_config_netobj *netobj
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_is_net
|
|
*===========================================================================
|
|
* Description: Returns IP_TRUE if the net object contains a network and
|
|
* netmask.
|
|
* Parameters: netobj - Net object
|
|
* Returns: IP_TRUE or IP_FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_netobj_is_net(
|
|
const Ipike_config_netobj *netobj
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_is_range
|
|
*===========================================================================
|
|
* Description: Returns IP_TRUE if the net object contains a address range.
|
|
* Parameters: netobj - Net object
|
|
* Returns: IP_TRUE or IP_FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_netobj_is_range(
|
|
const Ipike_config_netobj *netobj
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_is_valid
|
|
*===========================================================================
|
|
* Description: Returns IP_TRUE if the net object is valid.
|
|
* Parameters: netobj - Net object.
|
|
* Returns: IP_TRUE or IP_FALSE
|
|
*/
|
|
IP_GLOBAL Ip_bool
|
|
ipike_config_netobj_is_valid(
|
|
const Ipike_config_netobj *netobj
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_to_str
|
|
*===========================================================================
|
|
* Description: Returns a string representation of the net object in a static
|
|
* buffer that must NOT be freed.
|
|
* Parameters: netobj - Net object.
|
|
* Returns: A string representation.
|
|
*/
|
|
IP_GLOBAL const char *
|
|
ipike_config_netobj_to_str(
|
|
const Ipike_config_netobj *netobj
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_to_str_buf
|
|
*===========================================================================
|
|
* Description: Returns a string representation of the net object
|
|
* Parameters: netobj - Net object.
|
|
* buf - Buffer to place the result string in.
|
|
* size - Size of the buffer.
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL const char *
|
|
ipike_config_netobj_to_str_buf(
|
|
const Ipike_config_netobj* netobj,
|
|
char* buf,
|
|
Ip_size_t size
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_set_port_high
|
|
*===========================================================================
|
|
* Description: Sets the lower port limit in the net object.
|
|
* Parameters: netobj - Net object
|
|
* port - Port
|
|
* Returns: -
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_netobj_set_port_low(
|
|
Ipike_config_netobj* netobj,
|
|
Ip_u16 port
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_set_port_high
|
|
*===========================================================================
|
|
* Description: Sets the upper port limit in the net object.
|
|
* Parameters: netobj - Net object
|
|
* port - Port
|
|
* Returns: -
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_netobj_set_port_high(
|
|
Ipike_config_netobj* netobj,
|
|
Ip_u16 port
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_get_port_low
|
|
*===========================================================================
|
|
* Description: Gets the lower port limit in the net object.
|
|
* Parameters: netobj - Net object
|
|
* Returns: port if successful and 0 if fails.
|
|
*/
|
|
IP_GLOBAL Ip_u16
|
|
ipike_config_netobj_get_port_low(
|
|
const Ipike_config_netobj* netobj
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_get_port_high
|
|
*===========================================================================
|
|
* Description: Gets the higher port limit in the net object.
|
|
* Parameters: netobj - Net object
|
|
* Returns: port if successful and 0 if fails.
|
|
*/
|
|
IP_GLOBAL Ip_u16
|
|
ipike_config_netobj_get_port_high(
|
|
const Ipike_config_netobj *netobj
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_from_addr
|
|
*===========================================================================
|
|
* Description: Creates a net object from an address
|
|
* Parameters: netobj - Net object
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_netobj_from_addr(
|
|
Ipike_config_netobj *netobj,
|
|
union Ip_sockaddr_union *addr
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_to_str_buf
|
|
*===========================================================================
|
|
* Description: Creates a net object from a network and netmask
|
|
* Parameters: netobj - Net object
|
|
* network - Network address
|
|
* netmask - Netmask address
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_netobj_from_network(
|
|
Ipike_config_netobj* netobj,
|
|
union Ip_sockaddr_union* network,
|
|
union Ip_sockaddr_union* netmask
|
|
);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_from_range
|
|
*===========================================================================
|
|
* Description: Creates a net object from a range specified by a lower and
|
|
* upper bound.
|
|
* Parameters: netobj - Net object
|
|
* low - Lower network address
|
|
* high - Higher network address
|
|
* Returns: Standard IPIKE error code.
|
|
*/
|
|
IP_GLOBAL Ipike_error
|
|
ipike_config_netobj_from_range(
|
|
Ipike_config_netobj * netobj,
|
|
union Ip_sockaddr_union * low,
|
|
union Ip_sockaddr_union * high);
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipike_config_netobj_copy
|
|
*===========================================================================
|
|
* Description: Copies the net object in src to dst.
|
|
* Parameters: dst - Destination object
|
|
* src - Source object
|
|
* Returns: -
|
|
*/
|
|
IP_GLOBAL void
|
|
ipike_config_netobj_copy(
|
|
Ipike_config_netobj* dst,
|
|
const Ipike_config_netobj* src
|
|
);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|