560 lines
18 KiB
C
560 lines
18 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_h.h,v $ $Revision: 1.47.10.5 $
|
|
|
|
* $Source: /home/interpeak/CVSRoot/ipike/src/ipike_h.h,v $
|
|
* $Author: svc-cmnet $ $Date: 2013-03-13 07:45:26 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#ifndef IPIKE_H_H
|
|
#define IPIKE_H_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include "ipike_config.h"
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#if defined(IPCRYPTO) && !defined(IPCOM_USE_CLIB_PROTO)
|
|
#define IPCOM_USE_CLIB_PROTO
|
|
#endif
|
|
#include <ipcom.h>
|
|
#include <ipcom_os.h>
|
|
#include <ipcom_hash.h>
|
|
#include <ipcom_list.h>
|
|
#include <ipcom_tmo2.h>
|
|
#include <ipcom_time.h>
|
|
#include "ipike_util.h"
|
|
#include "ipike_configuration.h"
|
|
#include "ipike_pfkeyv2.h"
|
|
|
|
#ifdef IPIKE_USE_EVENT_LOG
|
|
#include "ipike_event_server.h"
|
|
/* Set event logging function before including ipike_event_log.h */
|
|
#define IPIKE_EVENT_LOG_FUNC ipike_event_server_log
|
|
#endif
|
|
|
|
#include "ipike_event_log.h"
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* Support IKE version 1 protocol. Disable of IKE v1 not fullt implemented
|
|
* yet, so this define MUST be set */
|
|
#define IPIKE_USE_VERSION1 1
|
|
|
|
/* The name this service is using in the IPD machinery */
|
|
#define IPIKE_IPD_NAME "ipike"
|
|
|
|
/* The name of the IKE daemon process */
|
|
#define IPIKE_PROC_NAME "ipiked"
|
|
|
|
/* The name of the IKE control command */
|
|
#define IPIKE_CMD_NAME "ike"
|
|
|
|
#define IPIKE_FREEP(p) do { ipcom_free((void *)p); p = IP_NULL; } while (0)
|
|
|
|
#ifdef IPIKE_USE_PKTINFO
|
|
#define IPIKE_PKT_CLEN 128
|
|
#else
|
|
#define IPIKE_PKT_CLEN 0
|
|
#endif
|
|
|
|
/* Mobility update related error messages */
|
|
#define IPIKE_MOBIKE_UPDATE_INITIATED 0
|
|
#define IPIKE_MOBIKE_INVALID_ADDRESS 1
|
|
#define IPIKE_MOBIKE_SIMILAR_ADDRESS 2
|
|
#define IPIKE_MOBIKE_LISTEN_NEW_FAILED 3
|
|
#define IPIKE_MOBIKE_UPDATE_FAILED 4
|
|
|
|
/* IKE MIP comm protocol msg types */
|
|
#define IPIKE_MOBIKE_UPDATE_LOCAL 0
|
|
#define IPIKE_MOBIKE_UPDATE_REMOTE 1 /* Not used currently */
|
|
#define IPIKE_MOBIKE_DYNAMIC_ADDRESS 2
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* syslog
|
|
*===========================================================================
|
|
*/
|
|
#define IPCOM_SYSLOG_PRIORITY IPIKE_SYSLOG_PRIORITY
|
|
#define IPCOM_SYSLOG_FACILITY IPCOM_LOG_IPIKE
|
|
|
|
|
|
#ifdef IPCOM_USE_INET6
|
|
#define IPIKE_ADDRSTRLEN IP_INET6_ADDRSTRLEN
|
|
#else
|
|
#define IPIKE_ADDRSTRLEN IP_INET_ADDRSTRLEN
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* code lock
|
|
*===========================================================================
|
|
*/
|
|
#define IPIKE_CODE_LOCK_INIT() if (ipike.code_lock_initialized == 0) \
|
|
if (ipcom_mutex_create(&ipike.code_mutex) == 0) \
|
|
ipike.code_lock_initialized = 1;
|
|
#define IPIKE_CODE_LOCK_INITIALIZED() (ipike.code_lock_initialized == 1)
|
|
|
|
#define IPIKE_CODE_LOCK_DESTROY() \
|
|
if (IPIKE_CODE_LOCK_INITIALIZED()) \
|
|
do { \
|
|
ipike.code_lock_initialized = 0; \
|
|
ipcom_mutex_delete(&ipike.code_mutex); \
|
|
} while(0)
|
|
|
|
|
|
|
|
#if defined (IP_ASSERT) && !defined(IP_PORT_LKM) && !defined(IP_PORT_VXWORKS)
|
|
#define IPIKE_CODE_ISLOCKED() if (IPIKE_CODE_LOCK_INITIALIZED()) \
|
|
ip_assert(ipike.code_mutex_count == 1)
|
|
#define IPIKE_CODE_LOCK() if (!IPIKE_CODE_LOCK_INITIALIZED()) \
|
|
IPIKE_CODE_LOCK_INIT(); \
|
|
if (IPIKE_CODE_LOCK_INITIALIZED()) { \
|
|
do { \
|
|
ipcom_mutex_lock(ipike.code_mutex); \
|
|
ipike.code_lock_owner = ipcom_getpid(); \
|
|
ip_assert(ipike.code_mutex_count == 0); \
|
|
ipike.code_mutex_count++; \
|
|
} while((0)); \
|
|
}
|
|
#define IPIKE_CODE_UNLOCK() if IPIKE_CODE_LOCK_INITIALIZED() { \
|
|
do { \
|
|
ip_assert(ipike.code_lock_owner == ipcom_getpid()); \
|
|
ip_assert(ipike.code_mutex_count == 1); \
|
|
ipike.code_mutex_count--; \
|
|
ipike.code_lock_owner = 0; \
|
|
ipcom_mutex_unlock(ipike.code_mutex); \
|
|
} while((0)); \
|
|
}
|
|
#else
|
|
#define IPIKE_CODE_ISLOCKED() IP_NOOP
|
|
#define IPIKE_CODE_LOCK() if (!IPIKE_CODE_LOCK_INITIALIZED()) \
|
|
IPIKE_CODE_LOCK_INIT(); \
|
|
if (IPIKE_CODE_LOCK_INITIALIZED()) \
|
|
ipcom_mutex_lock(ipike.code_mutex)
|
|
#define IPIKE_CODE_UNLOCK() if IPIKE_CODE_LOCK_INITIALIZED() \
|
|
ipcom_mutex_unlock(ipike.code_mutex)
|
|
#endif
|
|
|
|
#define IPIKE_IKE_SA_REACHED_LIMIT() \
|
|
((ipike.max_ike_sa_num != 0 && ipike.ike_sa_num >= ipike.max_ike_sa_num))
|
|
|
|
#define IPIKE_IPSEC_SA_REACHED_LIMIT() \
|
|
((ipike.max_ipsec_sa_num != 0 && ipike.ipsec_sa_num >= ipike.max_ipsec_sa_num))
|
|
|
|
|
|
#define IPIKE_FLOW_TYPE_ACQUIRE 12
|
|
#define IPIKE_FLOW_TYPE_REQUIRE 13
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_socket
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipike_socket_struct
|
|
{
|
|
Ipcom_list list;
|
|
union Ip_sockaddr_union addr;
|
|
Ip_fd fd;
|
|
} Ipike_socket;
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_flowtype_flow
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipike_flowtype_flow
|
|
{
|
|
Ipcom_list list;
|
|
Ipike_config_flow flow;
|
|
Ip_u8 flowtype;
|
|
} Ipike_flowtype_flow;
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_dispatcher
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipike_dispatcher_struct
|
|
{
|
|
Ip_bool initialized;
|
|
Ipcom_atomic_t reconfigure;
|
|
|
|
Ipcom_list sockets; /* List of listening IKE (UDP) sockets */
|
|
Ipcom_list flowtype_flows; /* List of 'require' or 'acquire' flows */
|
|
|
|
/* The UDP socket to listen for Radius messages on. */
|
|
#ifdef IPIKE_USE_RADIUS
|
|
Ip_fd* sock_radius;
|
|
Ip_u32 sock_radius_count;
|
|
Ip_u32 sock_radius_count_max;
|
|
#endif
|
|
|
|
/* Socket waiting for IKE SA dump requests */
|
|
Ip_fd shell_cmd_sock;
|
|
/* Ticks, used to determine when houskeeping should be performed */
|
|
int ticks;
|
|
/* Buffer where data can (temporarily) be stored */
|
|
Ip_size_t recv_buf_len;
|
|
void * recv_buf;
|
|
}
|
|
Ipike_dispatcher;
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_isakmp
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipike_isakmp_struct
|
|
{
|
|
Ip_bool initialized;
|
|
/* Hash tables with on-going ISAKMP exchanges */
|
|
Ipcom_hash* exchange_hash_table_cookie;
|
|
Ipcom_hash* exchange_hash_table_spi;
|
|
Ipcom_hash* exchange_hash_table_id;
|
|
}
|
|
Ipike_isakmp;
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_sadb
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipike_sadb_struct
|
|
{
|
|
Ip_bool initialized;
|
|
|
|
/* Hash tables with IKE SA:s in constructing and active state */
|
|
Ipcom_hash *cookie_hash_table;
|
|
|
|
/* Hash tables with the most recent IKE SA:s in active state for a peer */
|
|
Ipcom_hash *peer_addr_hash_table;
|
|
|
|
/* Hash tables with the most recent IKE SA:s in active state for a peer */
|
|
Ipcom_hash *peer_id_hash_table;
|
|
|
|
/* Hash table with IKE SA:s in constructing state */
|
|
Ipcom_hash *constructing_peer_addr_hash_table;
|
|
}
|
|
Ipike_sadb;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_ipsec_sadb
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipike_ipsec_sadb_struct
|
|
{
|
|
Ip_bool initialized;
|
|
|
|
/* Hash tables with all CHILD SA:s */
|
|
Ipcom_hash *child_hash_table;
|
|
|
|
/* Hash tables with active IPSec SA:s created from a specific configuration section */
|
|
Ipcom_hash *section_hash_table;
|
|
}
|
|
Ipike_ipsec_sadb;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_pfkeyv2
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipike_pfkeyv2_struct
|
|
{
|
|
Ip_bool initialized;
|
|
/* The UDP socket to listen for PF_KEY messages on */
|
|
Ip_fd sock;
|
|
/* The callback to use when a IPSec SA expires */
|
|
Ipike_sa_expire_cb sa_expire_cb;
|
|
/* The callback to use when IPSec need a new SA */
|
|
Ipike_sa_acquire_cb sa_acquire_cb;
|
|
/* The callback to use when IPSec SA is deleted */
|
|
Ipike_sa_remove_cb sa_remove_cb;
|
|
/* The callback to use when all IPSec SA is flushed */
|
|
Ipike_sa_flush_cb sa_flush_cb;
|
|
}
|
|
Ipike_pfkeyv2;
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_radius
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipike_radius_struct
|
|
{
|
|
Ip_bool initialized;
|
|
/* Hash tables with ongoing radius communication */
|
|
Ipcom_hash* hash_table;
|
|
/* Hash table with unique id's */
|
|
Ipcom_hash* unique_id_table;
|
|
}
|
|
Ipike_radius;
|
|
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipike_data
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipike_data_struct
|
|
{
|
|
Ipcom_atomic_t initialized;
|
|
Ip_u8 version_min; /* Minimum supported major version */
|
|
Ip_u8 version_max; /* Maximum supported major version */
|
|
|
|
/* Timout list (second timeout and liveness timeout) */
|
|
Ipcom_pqueue* tmo_head;
|
|
Ipcom_tmo2 housekeep_tmo;
|
|
|
|
Ip_u16 port;
|
|
Ip_u16 port_nat;
|
|
Ip_u16 keepalive_nat;
|
|
Ip_u16 liveness_timer_resolution;
|
|
Ip_u16 rekey_fuzz;
|
|
Ip_u16 http_request_timeout;
|
|
|
|
/* The IKE daemon process pid */
|
|
Ip_pid_t pid;
|
|
|
|
/* The IPD control socket */
|
|
Ip_fd ipd;
|
|
/* Set require_cookie to TRUE if responder require a cookie notify to
|
|
* verify a real request. */
|
|
Ip_bool require_cookie;
|
|
|
|
/* Allow certificates to be fetched via HTTP */
|
|
Ip_bool use_hash_and_url;
|
|
|
|
/* Initiate rekey for IPSec SA key for passive connections. */
|
|
Ip_bool rekey_passive;
|
|
|
|
/* Read/Write data */
|
|
Ipike_config_ike config;
|
|
Ipike_dispatcher disp;
|
|
Ipike_isakmp isakmp;
|
|
Ipike_sadb sadb;
|
|
Ipike_ipsec_sadb ipsec_sadb;
|
|
Ipike_pfkeyv2 pfkeyv2;
|
|
Ipike_radius radius;
|
|
|
|
/* Number of active IPSec SAs */
|
|
Ip_u32 active_inbound_ipsec_sa;
|
|
|
|
/* Number of active ISAKMP exchanges */
|
|
Ip_u32 active_exchanges;
|
|
|
|
/* The maximum number of concurrent IKE SAs */
|
|
Ip_u32 max_ike_sa_num;
|
|
|
|
/* The number of IKE SAs */
|
|
Ip_u32 ike_sa_num;
|
|
|
|
/* The maximum number of concurrent IPsec SAs */
|
|
Ip_u32 max_ipsec_sa_num;
|
|
|
|
/* The number of IPsec SAs */
|
|
Ip_u32 ipsec_sa_num;
|
|
|
|
/* The maximum size of an IKE message */
|
|
Ip_u32 max_ike_message_size;
|
|
|
|
/* This variable is used for performance testing */
|
|
Ip_bool running_performance_test;
|
|
|
|
/* This variable is used to allow duplicate IKE SAs to be created */
|
|
Ip_bool allow_duplicate_ike_sa;
|
|
|
|
/* This variable is used to temporary paus initiating of new IPSec SA */
|
|
Ip_bool paus_init_ipsec_sa;
|
|
|
|
/* This variable is used to create a traffic selector matching any responder address */
|
|
Ip_bool dynamic_ip_anyflow;
|
|
|
|
/* This variable is used to add the dynamic address as a home address */
|
|
Ip_bool dynamic_ip_homeaddr;
|
|
|
|
/* Enables strict lifetime policy, IKEv1 only */
|
|
Ip_bool strict_lifetime_policy;
|
|
|
|
/* Statistic variables */
|
|
struct Ip_timeval start;
|
|
|
|
/* Schedule shutdown */
|
|
Ip_bool schedule_shutdown;
|
|
|
|
/* Mutex to protect IPIKE global data. */
|
|
Ip_bool code_lock_initialized;
|
|
Ipcom_mutex code_mutex;
|
|
#if defined (IP_ASSERT) && !defined(IP_PORT_LKM) && !defined(IP_PORT_VXWORKS)
|
|
int code_mutex_count;
|
|
Ip_pid_t code_lock_owner;
|
|
#endif
|
|
|
|
#ifdef IPIKE_USE_EVENT_LOG
|
|
Ipike_channel_server *event_server;
|
|
#endif
|
|
/* Callbacks */
|
|
|
|
/*
|
|
*===========================================================================
|
|
* key_password_cb
|
|
*===========================================================================
|
|
* Description: Returns the password for the private key.
|
|
* Parameters: buf - The buffer to which the password should be copied
|
|
* size - The maximum size of the password buffer.
|
|
* rwflag -
|
|
* filename - The filename of the private key file.
|
|
* Returns: The length of the password.
|
|
*
|
|
*/
|
|
int (*key_password_cb)(char *buf, int size, int rwflag, void *filename);
|
|
|
|
/* Read only data */
|
|
const Ipike_string_int_map *authentication_method_map;
|
|
const Ipike_string_int_map *v2_authentication_method_map;
|
|
const Ipike_string_int_map *encryption_algorithm_map;
|
|
const Ipike_string_int_map *v2_encryption_algorithm_map;
|
|
const Ipike_string_int_map *encryption_algorithm_map2;
|
|
const Ipike_string_int_map *v2_encryption_algorithm_map2;
|
|
const Ipike_string_int_map *hash_algorithm_map;
|
|
const Ipike_string_int_map *dh_group_map;
|
|
const Ipike_string_int_map *life_type_map;
|
|
const Ipike_string_int_map *encapsulation_mode_map;
|
|
const Ipike_string_int_map *authentication_algorithm_map;
|
|
const Ipike_string_int_map *doi_map;
|
|
const Ipike_string_int_map *exchange_map;
|
|
const Ipike_string_int_map *payload_map;
|
|
const Ipike_string_int_map *notify_map;
|
|
const Ipike_string_int_map *cp_type_map;
|
|
const Ipike_string_int_map *cp_attr_map;
|
|
const Ipike_string_int_map *id_type_map;
|
|
const Ipike_string_int_map *id_proto_map;
|
|
const Ipike_string_int_map *proposal_proto_map;
|
|
const Ipike_string_int_map *transform_type_map;
|
|
const Ipike_string_int_map *transform_encr_id_map;
|
|
const Ipike_string_int_map *transform_prf_id_map;
|
|
const Ipike_string_int_map *transform_integ_id_map;
|
|
const Ipike_string_int_map *transform_dh_id_map;
|
|
const Ipike_string_int_map *isakmp_trans_id_map;
|
|
const Ipike_string_int_map *ipsec_ah_trans_id_map;
|
|
const Ipike_string_int_map *ipsec_esp_trans_id_map;
|
|
const Ipike_string_int_map *ipsec_esp_key_length_map;
|
|
const Ipike_string_int_map *ipsec_ipcomp_trans_id_map;
|
|
const Ipike_string_int_map *cert_encode_type_map;
|
|
const Ipike_string_int_map *x509_verify_err_map;
|
|
const Ipike_string_int_map *eap_code_map;
|
|
const Ipike_string_int_map *rohc_map;
|
|
|
|
char addr_buf[64];
|
|
}
|
|
Ipike_data;
|
|
|
|
#ifdef IPIKE_USE_PERF_EVAL
|
|
|
|
#define IPIKE_PHASE1 0
|
|
#define IPIKE_PHASE2 1
|
|
|
|
typedef struct Ipike_exchange_stats_struct
|
|
{
|
|
struct Ip_timeval ok_time;
|
|
struct Ip_timeval nok_time;
|
|
unsigned int ok_count;
|
|
unsigned int nok_count;
|
|
|
|
}Ipike_exchange_stats;
|
|
|
|
typedef struct Ipike_perf_struct
|
|
{
|
|
|
|
/* 5 IKEv1 exchange types supported */
|
|
Ipike_exchange_stats v1_stat[5];
|
|
/* 3 IKEv2 exchange types supported */
|
|
Ipike_exchange_stats v2_stat[3];
|
|
|
|
/* Rekey stats */
|
|
/* As of now only phase 2 rekey is valid */
|
|
Ipike_exchange_stats v1_rekey[2];
|
|
Ipike_exchange_stats v2_rekey[2];
|
|
|
|
}Ipike_perf;
|
|
|
|
/* YYAGII: Yck! Yet another global in IKE! */
|
|
IP_EXTERN Ipike_perf ipike_perf;
|
|
|
|
#endif /* #ifdef IPIKE_USE_PERF_EVAL */
|
|
|
|
IP_EXTERN Ipike_data ipike;
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
IP_GLOBAL Ipike_error
|
|
ipike_process_ipd_msg(Ip_fd ipd_sock);
|
|
|
|
IP_GLOBAL int
|
|
ipike_cmd(int argc, char** argv);
|
|
|
|
IP_GLOBAL const char *
|
|
ipike_version_number(void);
|
|
|
|
IP_PUBLIC const char *
|
|
ipike_version(void);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|