1c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh/* $NetBSD: remoteconf.h,v 1.7 2006/10/03 08:01:56 vanhu Exp $ */ 20a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 30a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* Id: remoteconf.h,v 1.26 2006/05/06 15:52:44 manubsd Exp */ 40a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 50a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* 60a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 70a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * All rights reserved. 80a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 90a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * Redistribution and use in source and binary forms, with or without 100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * modification, are permitted provided that the following conditions 110a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * are met: 120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 1. Redistributions of source code must retain the above copyright 130a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * notice, this list of conditions and the following disclaimer. 140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 2. Redistributions in binary form must reproduce the above copyright 150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * notice, this list of conditions and the following disclaimer in the 160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * documentation and/or other materials provided with the distribution. 170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 3. Neither the name of the project nor the names of its contributors 180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * may be used to endorse or promote products derived from this software 190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * without specific prior written permission. 200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * 210a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * SUCH DAMAGE. 320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang */ 330a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifndef _REMOTECONF_H 350a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#define _REMOTECONF_H 360a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 370a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* remote configuration */ 380a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 390a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include <sys/queue.h> 400a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "genlist.h" 410a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 420a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_var.h" 430a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#include "isakmp_xauth.h" 440a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 450a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 46c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehstruct proposalspec; 470a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 480a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstruct etypes { 490a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int type; 500a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct etypes *next; 510a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang}; 520a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 530a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang/* Script hooks */ 540a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#define SCRIPT_PHASE1_UP 0 550a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#define SCRIPT_PHASE1_DOWN 1 56c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#define SCRIPT_MAX 1 570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern char *script_names[SCRIPT_MAX + 1]; 580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstruct remoteconf { 600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct sockaddr *remote; /* remote IP address */ 610a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* if family is AF_UNSPEC, that is 620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * for anonymous configuration. */ 630a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 640a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct etypes *etypes; /* exchange type list. the head 650a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang * is a type to be sent first. */ 660a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int doitype; /* doi type */ 670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int sittype; /* situation type */ 680a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int idvtype; /* my identifier type */ 700a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *idv; /* my identifier */ 710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *key; /* my pre-shared key */ 720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct genlist *idvl_p; /* peer's identifiers list */ 730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 74c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int certtype; /* certificate type if need */ 75f8a6a7636d53a5730c58ae041e4e09ae12e1657cChia-chi Yeh char *mycertfile; /* file name of my certificate */ 76c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh char *myprivfile; /* file name of my private key file */ 770a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang char *peerscertfile; /* file name of peer's certifcate */ 78c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int getcert_method; /* the way to get peer's certificate */ 79c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int cacerttype; /* CA type is needed */ 800a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang char *cacertfile; /* file name of CA */ 81c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int getcacert_method; /* the way to get the CA */ 820a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int send_cert; /* send to CERT or not */ 830a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int send_cr; /* send to CR or not */ 840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int verify_cert; /* verify a CERT strictly */ 850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int verify_identifier; /* vefify the peer's identifier */ 860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int nonce_size; /* the number of bytes of nonce */ 870a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int passive; /* never initiate */ 880a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int ike_frag; /* IKE fragmentation */ 890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int esp_frag; /* ESP fragmentation */ 900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int mode_cfg; /* Gets config through mode config */ 910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int support_proxy; /* support mip6/proxy */ 92c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#define GENERATE_POLICY_NONE 0 93c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#define GENERATE_POLICY_REQUIRE 1 94c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#define GENERATE_POLICY_UNIQUE 2 950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int gen_policy; /* generate policy if no policy found */ 960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int ini_contact; /* initial contact */ 970a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int pcheck_level; /* level of propocl checking */ 980a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int nat_traversal; /* NAT-Traversal */ 990a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *script[SCRIPT_MAX + 1];/* script hooks paths */ 1000a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int dh_group; /* use it when only aggressive mode */ 1010a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct dhgroup *dhgrp; /* use it when only aggressive mode */ 1020a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang /* above two can't be defined by user*/ 1030a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 104c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int retry_counter; /* times to retry. */ 105c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int retry_interval; /* interval each retry. */ 106c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh /* above 2 values are copied from localconf. */ 107c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1080a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int dpd; /* Negociate DPD support ? */ 1090a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int dpd_retry; /* in seconds */ 1100a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int dpd_interval; /* in seconds */ 111c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int dpd_maxfails; 1120a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 113c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int ph1id; /* ph1id to be matched with sainfo sections */ 1140a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1150a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int weak_phase1_check; /* act on unencrypted deletions ? */ 1160a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1170a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct isakmpsa *proposal; /* proposal list */ 1180a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct remoteconf *inherited_from; /* the original rmconf 1190a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang from which this one 1200a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang was inherited */ 121c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct proposalspec *prhead; 1220a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1230a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct genlist *rsa_private, /* lists of PlainRSA keys to use */ 1240a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang *rsa_public; 1250a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1260a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#ifdef ENABLE_HYBRID 1270a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang struct xauth_rmconf *xauth; 1280a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif 1290a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1300a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang TAILQ_ENTRY(remoteconf) chain; /* next remote conf */ 1310a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang}; 1320a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 133f8a6a7636d53a5730c58ae041e4e09ae12e1657cChia-chi Yehstruct dhgroup; 1340a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 135c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh/* ISAKMP SA specification */ 136c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehstruct isakmpsa { 137c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int prop_no; 138c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int trns_no; 139c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh time_t lifetime; 140c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh size_t lifebyte; 141c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int enctype; 142c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int encklen; 143c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int authmethod; 144c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int hashtype; 145c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int vendorid; 146c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#ifdef HAVE_GSSAPI 147c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh vchar_t *gssid; 148c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh#endif 149c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh int dh_group; /* don't use it if aggressive mode */ 150c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct dhgroup *dhgrp; /* don't use it if aggressive mode */ 151c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 152c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct isakmpsa *next; /* next transform */ 153c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh struct remoteconf *rmconf; /* backpointer to remoteconf */ 154c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh}; 155c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh 1560a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangstruct idspec { 1570a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang int idtype; /* identifier type */ 1580a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang vchar_t *id; /* identifier */ 1590a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang}; 1600a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 161c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehtypedef struct remoteconf * (rmconf_func_t)(struct remoteconf *rmconf, void *data); 1620a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 163c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern struct remoteconf *getrmconf __P((struct sockaddr *)); 164c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern struct remoteconf *getrmconf_strict 165c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh __P((struct sockaddr *remote, int allow_anon)); 166c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern struct remoteconf *copyrmconf __P((struct sockaddr *)); 1670a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern struct remoteconf *newrmconf __P((void)); 168c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern struct remoteconf *duprmconf __P((struct remoteconf *)); 1690a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern void delrmconf __P((struct remoteconf *)); 170c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern void delisakmpsa __P((struct isakmpsa *)); 1710a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern void deletypes __P((struct etypes *)); 1720a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern struct etypes * dupetypes __P((struct etypes *)); 1730a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern void insrmconf __P((struct remoteconf *)); 1740a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern void remrmconf __P((struct remoteconf *)); 1750a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern void flushrmconf __P((void)); 1760a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern void initrmconf __P((void)); 177c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern void save_rmconf __P((void)); 178c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern void save_rmconf_flush __P((void)); 1790a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 180c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern struct etypes *check_etypeok 181c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh __P((struct remoteconf *, u_int8_t)); 182c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern struct remoteconf *foreachrmconf __P((rmconf_func_t rmconf_func, 183c91307af2622f6625525f3c1f9c954376df950adChia-chi Yeh void *data)); 1840a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1850a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern struct isakmpsa *newisakmpsa __P((void)); 1860a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern struct isakmpsa *dupisakmpsa __P((struct isakmpsa *)); 187f8a6a7636d53a5730c58ae041e4e09ae12e1657cChia-chi Yeh 188c91307af2622f6625525f3c1f9c954376df950adChia-chi Yehextern void insisakmpsa __P((struct isakmpsa *, struct remoteconf *)); 1890a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1900a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern void dumprmconf __P((void)); 1910a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1920a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern struct idspec *newidspec __P((void)); 1930a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1940a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wangextern vchar_t *script_path_add __P((vchar_t *)); 1950a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang 1960a1907d434839af6a9cb6329bbde60b237bf53dcChung-yih Wang#endif /* _REMOTECONF_H */ 197