1 /* $NetBSD: isakmp_cfg.h,v 1.6 2006/09/09 16:22:09 manu Exp $ */ 2 3 /* $KAME$ */ 4 5 /* 6 * Copyright (C) 2004 Emmanuel Dreyfus 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #ifdef HAVE_LIBPAM 35 #include <security/pam_appl.h> 36 #endif 37 38 #ifdef ANDROID_PATCHED 39 #include <arpa/inet.h> 40 #ifndef MAXNS 41 #define MAXNS 2 42 #endif 43 #endif 44 45 /* 46 * XXX don't forget to update 47 * src/racoon/handler.c:exclude_cfg_addr() 48 * if you add IPv6 capability 49 */ 50 51 /* Attribute types */ 52 #define INTERNAL_IP4_ADDRESS 1 53 #define INTERNAL_IP4_NETMASK 2 54 #define INTERNAL_IP4_DNS 3 55 #define INTERNAL_IP4_NBNS 4 56 #define INTERNAL_ADDRESS_EXPIRY 5 57 #define INTERNAL_IP4_DHCP 6 58 #define APPLICATION_VERSION 7 59 #define INTERNAL_IP6_ADDRESS 8 60 #define INTERNAL_IP6_NETMASK 9 61 #define INTERNAL_IP6_DNS 10 62 #define INTERNAL_IP6_NBNS 11 63 #define INTERNAL_IP6_DHCP 12 64 #define INTERNAL_IP4_SUBNET 13 65 #define SUPPORTED_ATTRIBUTES 14 66 #define INTERNAL_IP6_SUBNET 15 67 68 /* For APPLICATION_VERSION */ 69 #define ISAKMP_CFG_RACOON_VERSION "racoon / IPsec-tools" 70 71 /* For the wins servers -- XXX find the value somewhere ? */ 72 #define MAXWINS 4 73 74 /* 75 * Global configuration for ISAKMP mode confiration address allocation 76 * Read from the mode_cfg section of racoon.conf 77 */ 78 struct isakmp_cfg_port { 79 char used; 80 #ifdef HAVE_LIBPAM 81 pam_handle_t *pam; 82 #endif 83 }; 84 85 struct isakmp_cfg_config { 86 in_addr_t network4; 87 in_addr_t netmask4; 88 in_addr_t dns4[MAXNS]; 89 int dns4_index; 90 in_addr_t nbns4[MAXWINS]; 91 int nbns4_index; 92 struct isakmp_cfg_port *port_pool; 93 int authsource; 94 int groupsource; 95 char **grouplist; 96 int groupcount; 97 int confsource; 98 int accounting; 99 size_t pool_size; 100 int auth_throttle; 101 /* XXX move this to a unity specific sub-structure */ 102 char default_domain[MAXPATHLEN + 1]; 103 char motd[MAXPATHLEN + 1]; 104 struct unity_netentry *splitnet_list; 105 int splitnet_count; 106 int splitnet_type; 107 char *splitdns_list; 108 int splitdns_len; 109 int pfs_group; 110 int save_passwd; 111 }; 112 113 /* For utmp updating */ 114 #define TERMSPEC "vpn%d" 115 116 /* For authsource */ 117 #define ISAKMP_CFG_AUTH_SYSTEM 0 118 #define ISAKMP_CFG_AUTH_RADIUS 1 119 #define ISAKMP_CFG_AUTH_PAM 2 120 #define ISAKMP_CFG_AUTH_LDAP 4 121 122 /* For groupsource */ 123 #define ISAKMP_CFG_GROUP_SYSTEM 0 124 #define ISAKMP_CFG_GROUP_LDAP 1 125 126 /* For confsource */ 127 #define ISAKMP_CFG_CONF_LOCAL 0 128 #define ISAKMP_CFG_CONF_RADIUS 1 129 #define ISAKMP_CFG_CONF_LDAP 2 130 131 /* For accounting */ 132 #define ISAKMP_CFG_ACCT_NONE 0 133 #define ISAKMP_CFG_ACCT_RADIUS 1 134 #define ISAKMP_CFG_ACCT_PAM 2 135 #define ISAKMP_CFG_ACCT_LDAP 3 136 #define ISAKMP_CFG_ACCT_SYSTEM 4 137 138 /* For pool_size */ 139 #define ISAKMP_CFG_MAX_CNX 255 140 141 /* For motd */ 142 #define ISAKMP_CFG_MOTD "/etc/motd" 143 144 /* For default domain */ 145 #define ISAKMP_CFG_DEFAULT_DOMAIN "" 146 147 extern struct isakmp_cfg_config isakmp_cfg_config; 148 149 /* 150 * ISAKMP mode config state 151 */ 152 #define LOGINLEN 31 153 struct isakmp_cfg_state { 154 int flags; /* See below */ 155 unsigned int port; /* address index */ 156 char login[LOGINLEN + 1]; /* login */ 157 struct in_addr addr4; /* IPv4 address */ 158 struct in_addr mask4; /* IPv4 netmask */ 159 struct in_addr dns4[MAXNS]; /* IPv4 DNS (when client only) */ 160 int dns4_index; /* Number of IPv4 DNS (client only) */ 161 struct in_addr wins4[MAXWINS]; /* IPv4 WINS (when client only) */ 162 int wins4_index; /* Number of IPv4 WINS (client only) */ 163 char default_domain[MAXPATHLEN + 1]; /* Default domain recieved */ 164 struct unity_netentry 165 *split_include; /* UNITY_SPLIT_INCLUDE */ 166 int include_count; /* Number of SPLIT_INCLUDES */ 167 struct unity_netentry 168 *split_local; /* UNITY_LOCAL_LAN */ 169 int local_count; /* Number of SPLIT_LOCAL */ 170 struct xauth_state xauth; /* Xauth state, if revelant */ 171 struct isakmp_ivm *ivm; /* XXX Use iph1's ivm? */ 172 u_int32_t last_msgid; /* Last message-ID */ 173 }; 174 175 /* flags */ 176 #define ISAKMP_CFG_VENDORID_XAUTH 0x01 /* Supports Xauth */ 177 #define ISAKMP_CFG_VENDORID_UNITY 0x02 /* Cisco Unity compliant */ 178 #define ISAKMP_CFG_PORT_ALLOCATED 0x04 /* Port allocated */ 179 #define ISAKMP_CFG_ADDR4_EXTERN 0x08 /* Address from external config */ 180 #define ISAKMP_CFG_MASK4_EXTERN 0x10 /* Netmask from external config */ 181 #define ISAKMP_CFG_ADDR4_LOCAL 0x20 /* Address from local pool */ 182 #define ISAKMP_CFG_MASK4_LOCAL 0x40 /* Netmask from local pool */ 183 #define ISAKMP_CFG_GOT_ADDR4 0x80 /* Client got address */ 184 #define ISAKMP_CFG_GOT_MASK4 0x100 /* Client got mask */ 185 #define ISAKMP_CFG_GOT_DNS4 0x200 /* Client got DNS */ 186 #define ISAKMP_CFG_GOT_WINS4 0x400 /* Client got WINS */ 187 #define ISAKMP_CFG_DELETE_PH1 0x800 /* phase 1 should be deleted */ 188 #define ISAKMP_CFG_GOT_DEFAULT_DOMAIN 0x1000 /* Client got default domain */ 189 #define ISAKMP_CFG_GOT_SPLIT_INCLUDE 0x2000 /* Client got a split network config */ 190 #define ISAKMP_CFG_GOT_SPLIT_LOCAL 0x4000 /* Client got a split LAN config */ 191 192 struct isakmp_pl_attr; 193 struct ph1handle; 194 struct isakmp_ivm; 195 void isakmp_cfg_r(struct ph1handle *, vchar_t *); 196 int isakmp_cfg_attr_r(struct ph1handle *, u_int32_t, struct isakmp_pl_attr *); 197 int isakmp_cfg_reply(struct ph1handle *, struct isakmp_pl_attr *); 198 int isakmp_cfg_request(struct ph1handle *, struct isakmp_pl_attr *); 199 int isakmp_cfg_set(struct ph1handle *, struct isakmp_pl_attr *); 200 int isakmp_cfg_send(struct ph1handle *, vchar_t *, u_int32_t, int, int); 201 struct isakmp_ivm *isakmp_cfg_newiv(struct ph1handle *, u_int32_t); 202 void isakmp_cfg_rmstate(struct ph1handle *); 203 struct isakmp_cfg_state *isakmp_cfg_mkstate(void); 204 vchar_t *isakmp_cfg_copy(struct ph1handle *, struct isakmp_data *); 205 vchar_t *isakmp_cfg_short(struct ph1handle *, struct isakmp_data *, int); 206 vchar_t *isakmp_cfg_varlen(struct ph1handle *, struct isakmp_data *, char *, size_t); 207 vchar_t *isakmp_cfg_string(struct ph1handle *, struct isakmp_data *, char *); 208 int isakmp_cfg_getconfig(struct ph1handle *); 209 int isakmp_cfg_setenv(struct ph1handle *, char ***, int *); 210 211 int isakmp_cfg_resize_pool(int); 212 int isakmp_cfg_getport(struct ph1handle *); 213 int isakmp_cfg_putport(struct ph1handle *, unsigned int); 214 int isakmp_cfg_init(int); 215 #define ISAKMP_CFG_INIT_COLD 1 216 #define ISAKMP_CFG_INIT_WARM 0 217 218 #ifdef HAVE_LIBRADIUS 219 struct rad_handle; 220 extern struct rad_handle *radius_acct_state; 221 int isakmp_cfg_radius_common(struct rad_handle *, int); 222 #endif 223 224 #ifdef HAVE_LIBPAM 225 int isakmp_cfg_accounting_pam(int, int); 226 void cleanup_pam(int); 227 #endif 228 229 int isakmp_cfg_accounting_system(int, struct sockaddr *, char *, int); 230