1 /*	$NetBSD: isakmp_cfg.h,v 1.6 2006/09/09 16:22:09 manu Exp $	*/
2 
3 /*	$KAME$ */
4 
5 /*
6  * Copyright (C) 2004 Emmanuel Dreyfus
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #ifdef HAVE_LIBPAM
35 #include <security/pam_appl.h>
36 #endif
37 
38 #ifdef ANDROID_PATCHED
39 #include <arpa/inet.h>
40 #ifndef MAXNS
41 #define MAXNS 2
42 #endif
43 #endif
44 
45 /*
46  * XXX don't forget to update
47  * src/racoon/handler.c:exclude_cfg_addr()
48  * if you add IPv6 capability
49  */
50 
51 /* Attribute types */
52 #define INTERNAL_IP4_ADDRESS        1
53 #define INTERNAL_IP4_NETMASK        2
54 #define INTERNAL_IP4_DNS            3
55 #define INTERNAL_IP4_NBNS           4
56 #define INTERNAL_ADDRESS_EXPIRY     5
57 #define INTERNAL_IP4_DHCP           6
58 #define APPLICATION_VERSION         7
59 #define INTERNAL_IP6_ADDRESS        8
60 #define INTERNAL_IP6_NETMASK        9
61 #define INTERNAL_IP6_DNS           10
62 #define INTERNAL_IP6_NBNS          11
63 #define INTERNAL_IP6_DHCP          12
64 #define INTERNAL_IP4_SUBNET        13
65 #define SUPPORTED_ATTRIBUTES       14
66 #define INTERNAL_IP6_SUBNET        15
67 
68 /* For APPLICATION_VERSION */
69 #define ISAKMP_CFG_RACOON_VERSION "racoon / IPsec-tools"
70 
71 /* For the wins servers -- XXX find the value somewhere ? */
72 #define MAXWINS 4
73 
74 /*
75  * Global configuration for ISAKMP mode confiration address allocation
76  * Read from the mode_cfg section of racoon.conf
77  */
78 struct isakmp_cfg_port {
79 	char	used;
80 #ifdef HAVE_LIBPAM
81 	pam_handle_t *pam;
82 #endif
83 };
84 
85 struct isakmp_cfg_config {
86 	in_addr_t		network4;
87 	in_addr_t		netmask4;
88 	in_addr_t		dns4[MAXNS];
89 	int			dns4_index;
90 	in_addr_t		nbns4[MAXWINS];
91 	int			nbns4_index;
92 	struct isakmp_cfg_port 	*port_pool;
93 	int			authsource;
94 	int			groupsource;
95 	char			**grouplist;
96 	int			groupcount;
97 	int			confsource;
98 	int			accounting;
99 	size_t			pool_size;
100 	int			auth_throttle;
101 	/* XXX move this to a unity specific sub-structure */
102 	char			default_domain[MAXPATHLEN + 1];
103 	char			motd[MAXPATHLEN + 1];
104 	struct unity_netentry	*splitnet_list;
105 	int			splitnet_count;
106 	int			splitnet_type;
107 	char 			*splitdns_list;
108 	int			splitdns_len;
109 	int			pfs_group;
110 	int			save_passwd;
111 };
112 
113 /* For utmp updating */
114 #define TERMSPEC	"vpn%d"
115 
116 /* For authsource */
117 #define ISAKMP_CFG_AUTH_SYSTEM	0
118 #define ISAKMP_CFG_AUTH_RADIUS	1
119 #define ISAKMP_CFG_AUTH_PAM	2
120 #define ISAKMP_CFG_AUTH_LDAP	4
121 
122 /* For groupsource */
123 #define ISAKMP_CFG_GROUP_SYSTEM	0
124 #define ISAKMP_CFG_GROUP_LDAP	1
125 
126 /* For confsource */
127 #define ISAKMP_CFG_CONF_LOCAL	0
128 #define ISAKMP_CFG_CONF_RADIUS	1
129 #define ISAKMP_CFG_CONF_LDAP	2
130 
131 /* For accounting */
132 #define ISAKMP_CFG_ACCT_NONE	0
133 #define ISAKMP_CFG_ACCT_RADIUS	1
134 #define ISAKMP_CFG_ACCT_PAM	2
135 #define ISAKMP_CFG_ACCT_LDAP	3
136 #define ISAKMP_CFG_ACCT_SYSTEM	4
137 
138 /* For pool_size */
139 #define ISAKMP_CFG_MAX_CNX	255
140 
141 /* For motd */
142 #define ISAKMP_CFG_MOTD	"/etc/motd"
143 
144 /* For default domain */
145 #define ISAKMP_CFG_DEFAULT_DOMAIN ""
146 
147 extern struct isakmp_cfg_config isakmp_cfg_config;
148 
149 /*
150  * ISAKMP mode config state
151  */
152 #define LOGINLEN 31
153 struct isakmp_cfg_state {
154 	int flags;			/* See below */
155 	unsigned int port;		/* address index */
156 	char login[LOGINLEN + 1];	/* login */
157 	struct in_addr addr4;		/* IPv4 address */
158 	struct in_addr mask4;		/* IPv4 netmask */
159 	struct in_addr dns4[MAXNS];	/* IPv4 DNS (when client only) */
160 	int dns4_index;			/* Number of IPv4 DNS (client only) */
161 	struct in_addr wins4[MAXWINS];	/* IPv4 WINS (when client only) */
162 	int wins4_index;		/* Number of IPv4 WINS (client only) */
163 	char default_domain[MAXPATHLEN + 1];	/* Default domain recieved */
164 	struct unity_netentry
165 	    *split_include; 		/* UNITY_SPLIT_INCLUDE */
166 	int include_count;		/* Number of SPLIT_INCLUDES */
167 	struct unity_netentry
168 	    *split_local;		/* UNITY_LOCAL_LAN */
169 	int local_count;		/* Number of SPLIT_LOCAL */
170 	struct xauth_state xauth;	/* Xauth state, if revelant */
171 	struct isakmp_ivm *ivm;		/* XXX Use iph1's ivm? */
172 	u_int32_t last_msgid;           /* Last message-ID */
173 };
174 
175 /* flags */
176 #define ISAKMP_CFG_VENDORID_XAUTH	0x01	/* Supports Xauth */
177 #define ISAKMP_CFG_VENDORID_UNITY	0x02	/* Cisco Unity compliant */
178 #define ISAKMP_CFG_PORT_ALLOCATED	0x04	/* Port allocated */
179 #define ISAKMP_CFG_ADDR4_EXTERN		0x08	/* Address from external config  */
180 #define ISAKMP_CFG_MASK4_EXTERN		0x10	/* Netmask from external config */
181 #define ISAKMP_CFG_ADDR4_LOCAL		0x20	/* Address from local pool */
182 #define ISAKMP_CFG_MASK4_LOCAL		0x40	/* Netmask from local pool */
183 #define ISAKMP_CFG_GOT_ADDR4		0x80	/* Client got address */
184 #define ISAKMP_CFG_GOT_MASK4		0x100	/* Client got mask */
185 #define ISAKMP_CFG_GOT_DNS4		0x200	/* Client got DNS */
186 #define ISAKMP_CFG_GOT_WINS4		0x400	/* Client got WINS */
187 #define ISAKMP_CFG_DELETE_PH1		0x800	/* phase 1 should be deleted */
188 #define ISAKMP_CFG_GOT_DEFAULT_DOMAIN	0x1000	/* Client got default domain */
189 #define ISAKMP_CFG_GOT_SPLIT_INCLUDE	0x2000	/* Client got a split network config */
190 #define ISAKMP_CFG_GOT_SPLIT_LOCAL	0x4000	/* Client got a split LAN config */
191 
192 struct isakmp_pl_attr;
193 struct ph1handle;
194 struct isakmp_ivm;
195 void isakmp_cfg_r(struct ph1handle *, vchar_t *);
196 int isakmp_cfg_attr_r(struct ph1handle *, u_int32_t, struct isakmp_pl_attr *);
197 int isakmp_cfg_reply(struct ph1handle *, struct isakmp_pl_attr *);
198 int isakmp_cfg_request(struct ph1handle *, struct isakmp_pl_attr *);
199 int isakmp_cfg_set(struct ph1handle *, struct isakmp_pl_attr *);
200 int isakmp_cfg_send(struct ph1handle *, vchar_t *, u_int32_t, int, int);
201 struct isakmp_ivm *isakmp_cfg_newiv(struct ph1handle *, u_int32_t);
202 void isakmp_cfg_rmstate(struct ph1handle *);
203 struct isakmp_cfg_state *isakmp_cfg_mkstate(void);
204 vchar_t *isakmp_cfg_copy(struct ph1handle *, struct isakmp_data *);
205 vchar_t *isakmp_cfg_short(struct ph1handle *, struct isakmp_data *, int);
206 vchar_t *isakmp_cfg_varlen(struct ph1handle *, struct isakmp_data *, char *, size_t);
207 vchar_t *isakmp_cfg_string(struct ph1handle *, struct isakmp_data *, char *);
208 int isakmp_cfg_getconfig(struct ph1handle *);
209 int isakmp_cfg_setenv(struct ph1handle *, char ***, int *);
210 
211 int isakmp_cfg_resize_pool(int);
212 int isakmp_cfg_getport(struct ph1handle *);
213 int isakmp_cfg_putport(struct ph1handle *, unsigned int);
214 int isakmp_cfg_init(int);
215 #define ISAKMP_CFG_INIT_COLD	1
216 #define ISAKMP_CFG_INIT_WARM	0
217 
218 #ifdef HAVE_LIBRADIUS
219 struct rad_handle;
220 extern struct rad_handle *radius_acct_state;
221 int isakmp_cfg_radius_common(struct rad_handle *, int);
222 #endif
223 
224 #ifdef HAVE_LIBPAM
225 int isakmp_cfg_accounting_pam(int, int);
226 void cleanup_pam(int);
227 #endif
228 
229 int isakmp_cfg_accounting_system(int, struct sockaddr *, char *, int);
230